Cleaner warning of IP address leaking on embedded videos (#2034)

[github/Chocobozzz/PeerTube.git] / server / middlewares / validators / videos / video-playlists.ts

diff --git a/server/middlewares/validators/videos/video-playlists.ts b/server/middlewares/validators/videos/video-playlists.ts
index 4bc79f433b8584c9d3b591c528cc94dc2690e378..5823795be4a7af41c59b3036711effed4539f285 100644 (file)
--- a/server/middlewares/validators/videos/video-playlists.ts
+++ b/server/middlewares/validators/videos/video-playlists.ts
@@ -1,15 +1,22 @@
 import * as express from 'express'
-import { body, param, query, ValidationChain } from 'express-validator/check'
+import { body, param, query, ValidationChain } from 'express-validator'
 import { UserRight, VideoPlaylistCreate, VideoPlaylistUpdate } from '../../../../shared'
 import { logger } from '../../../helpers/logger'
 import { UserModel } from '../../../models/account/user'
 import { areValidationErrors } from '../utils'
-import { doesVideoExist, isVideoImage } from '../../../helpers/custom-validators/videos'
-import { CONSTRAINTS_FIELDS } from '../../../initializers'
-import { isArrayOf, isIdOrUUIDValid, isIdValid, isUUIDValid, toIntArray, toValueOrNull } from '../../../helpers/custom-validators/misc'
+import { isVideoImage } from '../../../helpers/custom-validators/videos'
+import { CONSTRAINTS_FIELDS } from '../../../initializers/constants'
+import {
+  isArrayOf,
+  isIdOrUUIDValid,
+  isIdValid,
+  isUUIDValid,
+  toIntArray,
+  toIntOrNull,
+  toValueOrNull
+} from '../../../helpers/custom-validators/misc'
 import {
   isVideoPlaylistDescriptionValid,
-  doesVideoPlaylistExist,
   isVideoPlaylistNameValid,
   isVideoPlaylistPrivacyValid,
   isVideoPlaylistTimestampValid,
@@ -17,14 +24,16 @@ import {
 } from '../../../helpers/custom-validators/video-playlists'
 import { VideoPlaylistModel } from '../../../models/video/video-playlist'
 import { cleanUpReqFiles } from '../../../helpers/express-utils'
-import { doesVideoChannelIdExist } from '../../../helpers/custom-validators/video-channels'
 import { VideoPlaylistElementModel } from '../../../models/video/video-playlist-element'
-import { VideoModel } from '../../../models/video/video'
 import { authenticatePromiseIfNeeded } from '../../oauth'
 import { VideoPlaylistPrivacy } from '../../../../shared/models/videos/playlist/video-playlist-privacy.model'
 import { VideoPlaylistType } from '../../../../shared/models/videos/playlist/video-playlist-type.model'
+import { doesVideoChannelIdExist, doesVideoExist, doesVideoPlaylistExist } from '../../../helpers/middlewares'
 
 const videoPlaylistsAddValidator = getCommonPlaylistEditAttributes().concat([
+  body('displayName')
+    .custom(isVideoPlaylistNameValid).withMessage('Should have a valid display name'),
+
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking videoPlaylistsAddValidator parameters', { parameters: req.body })
 
@@ -47,6 +56,10 @@ const videoPlaylistsUpdateValidator = getCommonPlaylistEditAttributes().concat([
   param('playlistId')
     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
 
+  body('displayName')
+    .optional()
+    .custom(isVideoPlaylistNameValid).withMessage('Should have a valid display name'),
+
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking videoPlaylistsUpdateValidator parameters', { parameters: req.body })
 
@@ -62,12 +75,6 @@ const videoPlaylistsUpdateValidator = getCommonPlaylistEditAttributes().concat([
 
     const body: VideoPlaylistUpdate = req.body
 
-    if (videoPlaylist.privacy !== VideoPlaylistPrivacy.PRIVATE && body.privacy === VideoPlaylistPrivacy.PRIVATE) {
-      cleanUpReqFiles(req)
-      return res.status(400)
-                .json({ error: 'Cannot set "private" a video playlist that was not private.' })
-    }
-
     const newPrivacy = body.privacy || videoPlaylist.privacy
     if (newPrivacy === VideoPlaylistPrivacy.PUBLIC &&
       (
@@ -103,7 +110,7 @@ const videoPlaylistsDeleteValidator = [
 
     if (!await doesVideoPlaylistExist(req.params.playlistId, res)) return
 
-    const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
+    const videoPlaylist = res.locals.videoPlaylist
     if (videoPlaylist.type === VideoPlaylistType.WATCH_LATER) {
       return res.status(400)
                 .json({ error: 'Cannot delete a watch later playlist.' })
@@ -128,7 +135,7 @@ const videoPlaylistsGetValidator = [
 
     if (!await doesVideoPlaylistExist(req.params.playlistId, res)) return
 
-    const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
+    const videoPlaylist = res.locals.videoPlaylist
 
     // Video is unlisted, check we used the uuid to fetch it
     if (videoPlaylist.privacy === VideoPlaylistPrivacy.UNLISTED) {
@@ -140,11 +147,11 @@ const videoPlaylistsGetValidator = [
     if (videoPlaylist.privacy === VideoPlaylistPrivacy.PRIVATE) {
       await authenticatePromiseIfNeeded(req, res)
 
-      const user: UserModel = res.locals.oauth ? res.locals.oauth.token.User : null
+      const user = res.locals.oauth ? res.locals.oauth.token.User : null
 
       if (
         !user ||
-        (videoPlaylist.OwnerAccount.userId !== user.id && !user.hasRight(UserRight.UPDATE_ANY_VIDEO_PLAYLIST))
+        (videoPlaylist.OwnerAccount.id !== user.Account.id && !user.hasRight(UserRight.UPDATE_ANY_VIDEO_PLAYLIST))
       ) {
         return res.status(403)
                   .json({ error: 'Cannot get this private video playlist.' })
@@ -177,8 +184,8 @@ const videoPlaylistsAddVideoValidator = [
     if (!await doesVideoPlaylistExist(req.params.playlistId, res, 'all')) return
     if (!await doesVideoExist(req.body.videoId, res, 'only-video')) return
 
-    const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
-    const video: VideoModel = res.locals.video
+    const videoPlaylist = res.locals.videoPlaylist
+    const video = res.locals.video
 
     const videoPlaylistElement = await VideoPlaylistElementModel.loadByPlaylistAndVideo(videoPlaylist.id, video.id)
     if (videoPlaylistElement) {
@@ -200,8 +207,8 @@ const videoPlaylistsAddVideoValidator = [
 const videoPlaylistsUpdateOrRemoveVideoValidator = [
   param('playlistId')
     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
-  param('videoId')
-    .custom(isIdOrUUIDValid).withMessage('Should have an video id/uuid'),
+  param('playlistElementId')
+    .custom(isIdValid).withMessage('Should have an element id/uuid'),
   body('startTimestamp')
     .optional()
     .custom(isVideoPlaylistTimestampValid).withMessage('Should have a valid start timestamp'),
@@ -215,12 +222,10 @@ const videoPlaylistsUpdateOrRemoveVideoValidator = [
     if (areValidationErrors(req, res)) return
 
     if (!await doesVideoPlaylistExist(req.params.playlistId, res, 'all')) return
-    if (!await doesVideoExist(req.params.videoId, res, 'id')) return
 
-    const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
-    const video: VideoModel = res.locals.video
+    const videoPlaylist = res.locals.videoPlaylist
 
-    const videoPlaylistElement = await VideoPlaylistElementModel.loadByPlaylistAndVideo(videoPlaylist.id, video.id)
+    const videoPlaylistElement = await VideoPlaylistElementModel.loadById(req.params.playlistElementId)
     if (!videoPlaylistElement) {
       res.status(404)
          .json({ error: 'Video playlist element not found' })
@@ -284,7 +289,7 @@ const videoPlaylistsReorderVideosValidator = [
 
     if (!await doesVideoPlaylistExist(req.params.playlistId, res, 'all')) return
 
-    const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
+    const videoPlaylist = res.locals.videoPlaylist
     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.UPDATE_ANY_VIDEO_PLAYLIST, res)) return
 
     const nextPosition = await VideoPlaylistElementModel.getNextPositionOf(videoPlaylist.id)
@@ -369,20 +374,17 @@ function getCommonPlaylistEditAttributes () {
       + CONSTRAINTS_FIELDS.VIDEO_PLAYLISTS.IMAGE.EXTNAME.join(', ')
     ),
 
-    body('displayName')
-      .custom(isVideoPlaylistNameValid).withMessage('Should have a valid display name'),
     body('description')
       .optional()
       .customSanitizer(toValueOrNull)
       .custom(isVideoPlaylistDescriptionValid).withMessage('Should have a valid description'),
     body('privacy')
       .optional()
-      .toInt()
+      .customSanitizer(toIntOrNull)
       .custom(isVideoPlaylistPrivacyValid).withMessage('Should have correct playlist privacy'),
     body('videoChannelId')
       .optional()
-      .customSanitizer(toValueOrNull)
-      .toInt()
+      .customSanitizer(toIntOrNull)
   ] as (ValidationChain | express.Handler)[]
 }