X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Fmiddlewares%2Fvalidators%2Foembed.ts;h=fc1a294e0898ef56cac18ef8970579996f9e3760;hb=5d2fd66ab4a75281dab6363ba9131adee7be3a2b;hp=96c8adc99cbac26d415f2f1ef9ed05bd502e8953;hpb=7d786e5c1621e1aa41db1d6e7244f16df7343d45;p=github%2FChocobozzz%2FPeerTube.git diff --git a/server/middlewares/validators/oembed.ts b/server/middlewares/validators/oembed.ts index 96c8adc99..fc1a294e0 100644 --- a/server/middlewares/validators/oembed.ts +++ b/server/middlewares/validators/oembed.ts @@ -6,7 +6,7 @@ import { VideoPlaylistModel } from '@server/models/video/video-playlist' import { VideoPlaylistPrivacy, VideoPrivacy } from '@shared/models' import { HttpStatusCode } from '../../../shared/models/http/http-error-codes' import { isTestInstance } from '../../helpers/core-utils' -import { isIdOrUUIDValid, toCompleteUUID } from '../../helpers/custom-validators/misc' +import { isIdOrUUIDValid, isUUIDValid, toCompleteUUID } from '../../helpers/custom-validators/misc' import { logger } from '../../helpers/logger' import { WEBSERVER } from '../../initializers/constants' import { areValidationErrors } from './shared' @@ -28,7 +28,6 @@ function buildUrls (paths: string[]) { const startPlaylistURLs = buildUrls(playlistPaths) const startVideoURLs = buildUrls(videoPaths) -const watchRegex = /([^/]+)$/ const isURLOptions = { require_host: true, require_tld: true @@ -81,9 +80,9 @@ const oembedValidator = [ const startIsOk = isVideo || isPlaylist - const matches = watchRegex.exec(urlPath) + const parts = urlPath.split('/') - if (startIsOk === false || matches === null) { + if (startIsOk === false || parts.length === 0) { return res.fail({ status: HttpStatusCode.BAD_REQUEST_400, message: 'Invalid url.', @@ -93,7 +92,7 @@ const oembedValidator = [ }) } - const elementId = toCompleteUUID(matches[1]) + const elementId = toCompleteUUID(parts.pop()) if (isIdOrUUIDValid(elementId) === false) { return res.fail({ message: 'Invalid video or playlist id.' }) } @@ -108,15 +107,18 @@ const oembedValidator = [ }) } - if (video.privacy !== VideoPrivacy.PUBLIC) { - return res.fail({ - status: HttpStatusCode.FORBIDDEN_403, - message: 'Video is not public' - }) + if ( + video.privacy === VideoPrivacy.PUBLIC || + (video.privacy === VideoPrivacy.UNLISTED && isUUIDValid(elementId) === true) + ) { + res.locals.videoAll = video + return next() } - res.locals.videoAll = video - return next() + return res.fail({ + status: HttpStatusCode.FORBIDDEN_403, + message: 'Video is not publicly available' + }) } // Is playlist @@ -129,15 +131,18 @@ const oembedValidator = [ }) } - if (videoPlaylist.privacy !== VideoPlaylistPrivacy.PUBLIC) { - return res.fail({ - status: HttpStatusCode.FORBIDDEN_403, - message: 'Playlist is not public' - }) + if ( + videoPlaylist.privacy === VideoPlaylistPrivacy.PUBLIC || + (videoPlaylist.privacy === VideoPlaylistPrivacy.UNLISTED && isUUIDValid(elementId)) + ) { + res.locals.videoPlaylistSummary = videoPlaylist + return next() } - res.locals.videoPlaylistSummary = videoPlaylist - return next() + return res.fail({ + status: HttpStatusCode.FORBIDDEN_403, + message: 'Playlist is not public' + }) } ]