X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Fmiddlewares%2Fvalidators%2Fusers.ts;h=055af3b64c851209ecd24c97614c6c1ca3175d86;hb=2f061e065ab43cc0b73595b619639a92952aeeba;hp=6d306121ef47bf86fb112cc25c09a3c9d612a014;hpb=a2fb5fb8b1007e3ce82e707917f5d9a37374e99b;p=github%2FChocobozzz%2FPeerTube.git

diff --git a/server/middlewares/validators/users.ts b/server/middlewares/validators/users.ts
index 6d306121e..055af3b64 100644
--- a/server/middlewares/validators/users.ts
+++ b/server/middlewares/validators/users.ts
@@ -1,10 +1,8 @@
 import express from 'express'
 import { body, param, query } from 'express-validator'
-import { omit } from 'lodash'
 import { Hooks } from '@server/lib/plugins/hooks'
-import { MUserDefault } from '@server/types/models'
 import { HttpStatusCode, UserRegister, UserRight, UserRole } from '@shared/models'
-import { isBooleanValid, isIdValid, toBooleanOrNull, toIntOrNull } from '../../helpers/custom-validators/misc'
+import { exists, isBooleanValid, isIdValid, toBooleanOrNull, toIntOrNull } from '../../helpers/custom-validators/misc'
 import { isThemeNameValid } from '../../helpers/custom-validators/plugins'
 import {
   isUserAdminFlagsValid,
@@ -31,18 +29,23 @@ import { isThemeRegistered } from '../../lib/plugins/theme-utils'
 import { Redis } from '../../lib/redis'
 import { isSignupAllowed, isSignupAllowedForCurrentIP } from '../../lib/signup'
 import { ActorModel } from '../../models/actor/actor'
-import { UserModel } from '../../models/user/user'
-import { areValidationErrors, doesVideoChannelIdExist, doesVideoExist, isValidVideoIdParam } from './shared'
+import {
+  areValidationErrors,
+  checkUserEmailExist,
+  checkUserIdExist,
+  checkUserNameOrEmailDoesNotAlreadyExist,
+  doesVideoChannelIdExist,
+  doesVideoExist,
+  isValidVideoIdParam
+} from './shared'
 
 const usersListValidator = [
   query('blocked')
     .optional()
     .customSanitizer(toBooleanOrNull)
-    .isBoolean().withMessage('Should be a valid boolean banned state'),
+    .isBoolean().withMessage('Should be a valid blocked boolena'),
 
   (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersList parameters', { parameters: req.query })
-
     if (areValidationErrors(req, res)) return
 
     return next()
@@ -50,24 +53,33 @@ const usersListValidator = [
 ]
 
 const usersAddValidator = [
-  body('username').custom(isUserUsernameValid).withMessage('Should have a valid username (lowercase alphanumeric characters)'),
-  body('password').custom(isUserPasswordValidOrEmpty).withMessage('Should have a valid password'),
-  body('email').isEmail().withMessage('Should have a valid email'),
+  body('username')
+    .custom(isUserUsernameValid)
+    .withMessage('Should have a valid username (lowercase alphanumeric characters)'),
+  body('password')
+    .custom(isUserPasswordValidOrEmpty),
+  body('email')
+    .isEmail(),
 
-  body('channelName').optional().custom(isVideoChannelUsernameValid).withMessage('Should have a valid channel name'),
+  body('channelName')
+    .optional()
+    .custom(isVideoChannelUsernameValid),
 
-  body('videoQuota').custom(isUserVideoQuotaValid).withMessage('Should have a valid user quota'),
-  body('videoQuotaDaily').custom(isUserVideoQuotaDailyValid).withMessage('Should have a valid daily user quota'),
+  body('videoQuota')
+    .custom(isUserVideoQuotaValid),
+  body('videoQuotaDaily')
+    .custom(isUserVideoQuotaDailyValid),
 
   body('role')
     .customSanitizer(toIntOrNull)
-    .custom(isUserRoleValid).withMessage('Should have a valid role'),
-  body('adminFlags').optional().custom(isUserAdminFlagsValid).withMessage('Should have a valid admin flags'),
+    .custom(isUserRoleValid),
 
-  async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersAdd parameters', { parameters: omit(req.body, 'password') })
+  body('adminFlags')
+    .optional()
+    .custom(isUserAdminFlagsValid),
 
-    if (areValidationErrors(req, res)) return
+  async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+    if (areValidationErrors(req, res, { omitBodyLog: true })) return
     if (!await checkUserNameOrEmailDoesNotAlreadyExist(req.body.username, req.body.email, res)) return
 
     const authUser = res.locals.oauth.token.User
@@ -97,24 +109,25 @@ const usersAddValidator = [
 ]
 
 const usersRegisterValidator = [
-  body('username').custom(isUserUsernameValid).withMessage('Should have a valid username'),
-  body('password').custom(isUserPasswordValid).withMessage('Should have a valid password'),
-  body('email').isEmail().withMessage('Should have a valid email'),
+  body('username')
+    .custom(isUserUsernameValid),
+  body('password')
+    .custom(isUserPasswordValid),
+  body('email')
+    .isEmail(),
   body('displayName')
     .optional()
-    .custom(isUserDisplayNameValid).withMessage('Should have a valid display name'),
+    .custom(isUserDisplayNameValid),
 
   body('channel.name')
     .optional()
-    .custom(isVideoChannelUsernameValid).withMessage('Should have a valid channel name'),
+    .custom(isVideoChannelUsernameValid),
   body('channel.displayName')
     .optional()
-    .custom(isVideoChannelDisplayNameValid).withMessage('Should have a valid display name'),
+    .custom(isVideoChannelDisplayNameValid),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersRegister parameters', { parameters: omit(req.body, 'password') })
-
-    if (areValidationErrors(req, res)) return
+    if (areValidationErrors(req, res, { omitBodyLog: true })) return
     if (!await checkUserNameOrEmailDoesNotAlreadyExist(req.body.username, req.body.email, res)) return
 
     const body: UserRegister = req.body
@@ -141,11 +154,10 @@ const usersRegisterValidator = [
 ]
 
 const usersRemoveValidator = [
-  param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
+  param('id')
+    .custom(isIdValid),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersRemove parameters', { parameters: req.params })
-
     if (areValidationErrors(req, res)) return
     if (!await checkUserIdExist(req.params.id, res)) return
 
@@ -159,12 +171,13 @@ const usersRemoveValidator = [
 ]
 
 const usersBlockingValidator = [
-  param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
-  body('reason').optional().custom(isUserBlockedReasonValid).withMessage('Should have a valid blocking reason'),
+  param('id')
+    .custom(isIdValid),
+  body('reason')
+    .optional()
+    .custom(isUserBlockedReasonValid),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersBlocking parameters', { parameters: req.params })
-
     if (areValidationErrors(req, res)) return
     if (!await checkUserIdExist(req.params.id, res)) return
 
@@ -189,24 +202,36 @@ const deleteMeValidator = [
 ]
 
 const usersUpdateValidator = [
-  param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
-
-  body('password').optional().custom(isUserPasswordValid).withMessage('Should have a valid password'),
-  body('email').optional().isEmail().withMessage('Should have a valid email attribute'),
-  body('emailVerified').optional().isBoolean().withMessage('Should have a valid email verified attribute'),
-  body('videoQuota').optional().custom(isUserVideoQuotaValid).withMessage('Should have a valid user quota'),
-  body('videoQuotaDaily').optional().custom(isUserVideoQuotaDailyValid).withMessage('Should have a valid daily user quota'),
-  body('pluginAuth').optional(),
+  param('id').custom(isIdValid),
+
+  body('password')
+    .optional()
+    .custom(isUserPasswordValid),
+  body('email')
+    .optional()
+    .isEmail(),
+  body('emailVerified')
+    .optional()
+    .isBoolean(),
+  body('videoQuota')
+    .optional()
+    .custom(isUserVideoQuotaValid),
+  body('videoQuotaDaily')
+    .optional()
+    .custom(isUserVideoQuotaDailyValid),
+  body('pluginAuth')
+    .optional()
+    .exists(),
   body('role')
     .optional()
     .customSanitizer(toIntOrNull)
-    .custom(isUserRoleValid).withMessage('Should have a valid role'),
-  body('adminFlags').optional().custom(isUserAdminFlagsValid).withMessage('Should have a valid admin flags'),
+    .custom(isUserRoleValid),
+  body('adminFlags')
+    .optional()
+    .custom(isUserAdminFlagsValid),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersUpdate parameters', { parameters: req.body })
-
-    if (areValidationErrors(req, res)) return
+    if (areValidationErrors(req, res, { omitBodyLog: true })) return
     if (!await checkUserIdExist(req.params.id, res)) return
 
     const user = res.locals.user
@@ -221,37 +246,37 @@ const usersUpdateValidator = [
 const usersUpdateMeValidator = [
   body('displayName')
     .optional()
-    .custom(isUserDisplayNameValid).withMessage('Should have a valid display name'),
+    .custom(isUserDisplayNameValid),
   body('description')
     .optional()
-    .custom(isUserDescriptionValid).withMessage('Should have a valid description'),
+    .custom(isUserDescriptionValid),
   body('currentPassword')
     .optional()
-    .custom(isUserPasswordValid).withMessage('Should have a valid current password'),
+    .custom(isUserPasswordValid),
   body('password')
     .optional()
-    .custom(isUserPasswordValid).withMessage('Should have a valid password'),
+    .custom(isUserPasswordValid),
   body('email')
     .optional()
-    .isEmail().withMessage('Should have a valid email attribute'),
+    .isEmail(),
   body('nsfwPolicy')
     .optional()
-    .custom(isUserNSFWPolicyValid).withMessage('Should have a valid display Not Safe For Work policy'),
+    .custom(isUserNSFWPolicyValid),
   body('autoPlayVideo')
     .optional()
-    .custom(isUserAutoPlayVideoValid).withMessage('Should have a valid automatically plays video attribute'),
+    .custom(isUserAutoPlayVideoValid),
   body('p2pEnabled')
     .optional()
     .custom(isUserP2PEnabledValid).withMessage('Should have a valid p2p enabled boolean'),
   body('videoLanguages')
     .optional()
-    .custom(isUserVideoLanguages).withMessage('Should have a valid video languages attribute'),
+    .custom(isUserVideoLanguages),
   body('videosHistoryEnabled')
     .optional()
-    .custom(isUserVideosHistoryEnabledValid).withMessage('Should have a valid videos history enabled attribute'),
+    .custom(isUserVideosHistoryEnabledValid).withMessage('Should have a valid videos history enabled boolean'),
   body('theme')
     .optional()
-    .custom(v => isThemeNameValid(v) && isThemeRegistered(v)).withMessage('Should have a valid theme'),
+    .custom(v => isThemeNameValid(v) && isThemeRegistered(v)),
 
   body('noInstanceConfigWarningModal')
     .optional()
@@ -268,8 +293,6 @@ const usersUpdateMeValidator = [
     .custom(v => isUserAutoPlayNextVideoValid(v)).withMessage('Should have a valid autoPlayNextVideo boolean'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersUpdateMe parameters', { parameters: omit(req.body, 'password') })
-
     const user = res.locals.oauth.token.User
 
     if (req.body.password || req.body.email) {
@@ -289,19 +312,20 @@ const usersUpdateMeValidator = [
       }
     }
 
-    if (areValidationErrors(req, res)) return
+    if (areValidationErrors(req, res, { omitBodyLog: true })) return
 
     return next()
   }
 ]
 
 const usersGetValidator = [
-  param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
-  query('withStats').optional().isBoolean().withMessage('Should have a valid stats flag'),
+  param('id')
+    .custom(isIdValid),
+  query('withStats')
+    .optional()
+    .isBoolean().withMessage('Should have a valid withStats boolean'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersGet parameters', { parameters: req.params })
-
     if (areValidationErrors(req, res)) return
     if (!await checkUserIdExist(req.params.id, res, req.query.withStats)) return
 
@@ -313,8 +337,6 @@ const usersVideoRatingValidator = [
   isValidVideoIdParam('videoId'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersVideoRating parameters', { parameters: req.params })
-
     if (areValidationErrors(req, res)) return
     if (!await doesVideoExist(req.params.videoId, res, 'id')) return
 
@@ -326,16 +348,14 @@ const usersVideosValidator = [
   query('isLive')
     .optional()
     .customSanitizer(toBooleanOrNull)
-    .custom(isBooleanValid).withMessage('Should have a valid live boolean'),
+    .custom(isBooleanValid).withMessage('Should have a valid isLive boolean'),
 
   query('channelId')
     .optional()
     .customSanitizer(toIntOrNull)
-    .custom(isIdValid).withMessage('Should have a valid channel id'),
+    .custom(isIdValid),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersVideosValidator parameters', { parameters: req.query })
-
     if (areValidationErrors(req, res)) return
 
     if (req.query.channelId && !await doesVideoChannelIdExist(req.query.channelId, res)) return
@@ -384,11 +404,10 @@ const ensureUserRegistrationAllowedForIP = [
 ]
 
 const usersAskResetPasswordValidator = [
-  body('email').isEmail().not().isEmpty().withMessage('Should have a valid email'),
+  body('email')
+    .isEmail(),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersAskResetPassword parameters', { parameters: req.body })
-
     if (areValidationErrors(req, res)) return
 
     const exists = await checkUserEmailExist(req.body.email, res, false)
@@ -398,23 +417,31 @@ const usersAskResetPasswordValidator = [
       return res.status(HttpStatusCode.NO_CONTENT_204).end()
     }
 
+    if (res.locals.user.pluginAuth) {
+      return res.fail({
+        status: HttpStatusCode.CONFLICT_409,
+        message: 'Cannot recover password of a user that uses a plugin authentication.'
+      })
+    }
+
     return next()
   }
 ]
 
 const usersResetPasswordValidator = [
-  param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
-  body('verificationString').not().isEmpty().withMessage('Should have a valid verification string'),
-  body('password').custom(isUserPasswordValid).withMessage('Should have a valid password'),
+  param('id')
+    .custom(isIdValid),
+  body('verificationString')
+    .not().isEmpty(),
+  body('password')
+    .custom(isUserPasswordValid),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersResetPassword parameters', { parameters: req.params })
-
     if (areValidationErrors(req, res)) return
     if (!await checkUserIdExist(req.params.id, res)) return
 
     const user = res.locals.user
-    const redisVerificationString = await Redis.Instance.getResetPasswordLink(user.id)
+    const redisVerificationString = await Redis.Instance.getResetPasswordVerificationString(user.id)
 
     if (redisVerificationString !== req.body.verificationString) {
       return res.fail({
@@ -431,9 +458,8 @@ const usersAskSendVerifyEmailValidator = [
   body('email').isEmail().not().isEmpty().withMessage('Should have a valid email'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking askUsersSendVerifyEmail parameters', { parameters: req.body })
-
     if (areValidationErrors(req, res)) return
+
     const exists = await checkUserEmailExist(req.body.email, res, false)
     if (!exists) {
       logger.debug('User with email %s does not exist (asking verify email).', req.body.email)
@@ -441,6 +467,13 @@ const usersAskSendVerifyEmailValidator = [
       return res.status(HttpStatusCode.NO_CONTENT_204).end()
     }
 
+    if (res.locals.user.pluginAuth) {
+      return res.fail({
+        status: HttpStatusCode.CONFLICT_409,
+        message: 'Cannot ask verification email of a user that uses a plugin authentication.'
+      })
+    }
+
     return next()
   }
 ]
@@ -456,8 +489,6 @@ const usersVerifyEmailValidator = [
     .customSanitizer(toBooleanOrNull),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking usersVerifyEmail parameters', { parameters: req.params })
-
     if (areValidationErrors(req, res)) return
     if (!await checkUserIdExist(req.params.id, res)) return
 
@@ -475,8 +506,45 @@ const usersVerifyEmailValidator = [
   }
 ]
 
+const usersCheckCurrentPasswordFactory = (targetUserIdGetter: (req: express.Request) => number | string) => {
+  return [
+    body('currentPassword').optional().custom(exists),
+
+    async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+      if (areValidationErrors(req, res)) return
+
+      const user = res.locals.oauth.token.User
+      const isAdminOrModerator = user.role === UserRole.ADMINISTRATOR || user.role === UserRole.MODERATOR
+      const targetUserId = parseInt(targetUserIdGetter(req) + '')
+
+      // Admin/moderator action on another user, skip the password check
+      if (isAdminOrModerator && targetUserId !== user.id) {
+        return next()
+      }
+
+      if (!req.body.currentPassword) {
+        return res.fail({
+          status: HttpStatusCode.BAD_REQUEST_400,
+          message: 'currentPassword is missing'
+        })
+      }
+
+      if (await user.isPasswordMatch(req.body.currentPassword) !== true) {
+        return res.fail({
+          status: HttpStatusCode.FORBIDDEN_403,
+          message: 'currentPassword is invalid.'
+        })
+      }
+
+      return next()
+    }
+  ]
+}
+
 const userAutocompleteValidator = [
-  param('search').isString().not().isEmpty().withMessage('Should have a search parameter')
+  param('search')
+    .isString()
+    .not().isEmpty()
 ]
 
 const ensureAuthUserOwnsAccountValidator = [
@@ -494,13 +562,14 @@ const ensureAuthUserOwnsAccountValidator = [
   }
 ]
 
-const ensureCanManageChannel = [
+const ensureCanManageChannelOrAccount = [
   (req: express.Request, res: express.Response, next: express.NextFunction) => {
     const user = res.locals.oauth.token.user
-    const isUserOwner = res.locals.videoChannel.Account.userId === user.id
+    const account = res.locals.videoChannel?.Account ?? res.locals.account
+    const isUserOwner = account.userId === user.id
 
     if (!isUserOwner && user.hasRight(UserRight.MANAGE_ANY_VIDEO_CHANNEL) === false) {
-      const message = `User ${user.username} does not have right to manage channel ${req.params.nameWithHost}.`
+      const message = `User ${user.username} does not have right this channel or account.`
 
       return res.fail({
         status: HttpStatusCode.FORBIDDEN_403,
@@ -512,7 +581,7 @@ const ensureCanManageChannel = [
   }
 ]
 
-const ensureCanManageUser = [
+const ensureCanModerateUser = [
   (req: express.Request, res: express.Response, next: express.NextFunction) => {
     const authUser = res.locals.oauth.token.User
     const onUser = res.locals.user
@@ -522,7 +591,7 @@ const ensureCanManageUser = [
 
     return res.fail({
       status: HttpStatusCode.FORBIDDEN_403,
-      message: 'A moderator can only manager users.'
+      message: 'A moderator can only manage users.'
     })
   }
 ]
@@ -539,6 +608,7 @@ export {
   usersUpdateValidator,
   usersUpdateMeValidator,
   usersVideoRatingValidator,
+  usersCheckCurrentPasswordFactory,
   ensureUserRegistrationAllowed,
   ensureUserRegistrationAllowedForIP,
   usersGetValidator,
@@ -549,58 +619,6 @@ export {
   usersVerifyEmailValidator,
   userAutocompleteValidator,
   ensureAuthUserOwnsAccountValidator,
-  ensureCanManageUser,
-  ensureCanManageChannel
-}
-
-// ---------------------------------------------------------------------------
-
-function checkUserIdExist (idArg: number | string, res: express.Response, withStats = false) {
-  const id = parseInt(idArg + '', 10)
-  return checkUserExist(() => UserModel.loadByIdWithChannels(id, withStats), res)
-}
-
-function checkUserEmailExist (email: string, res: express.Response, abortResponse = true) {
-  return checkUserExist(() => UserModel.loadByEmail(email), res, abortResponse)
-}
-
-async function checkUserNameOrEmailDoesNotAlreadyExist (username: string, email: string, res: express.Response) {
-  const user = await UserModel.loadByUsernameOrEmail(username, email)
-
-  if (user) {
-    res.fail({
-      status: HttpStatusCode.CONFLICT_409,
-      message: 'User with this username or email already exists.'
-    })
-    return false
-  }
-
-  const actor = await ActorModel.loadLocalByName(username)
-  if (actor) {
-    res.fail({
-      status: HttpStatusCode.CONFLICT_409,
-      message: 'Another actor (account/channel) with this name on this instance already exists or has already existed.'
-    })
-    return false
-  }
-
-  return true
-}
-
-async function checkUserExist (finder: () => Promise<MUserDefault>, res: express.Response, abortResponse = true) {
-  const user = await finder()
-
-  if (!user) {
-    if (abortResponse === true) {
-      res.fail({
-        status: HttpStatusCode.NOT_FOUND_404,
-        message: 'User not found'
-      })
-    }
-
-    return false
-  }
-
-  res.locals.user = user
-  return true
+  ensureCanModerateUser,
+  ensureCanManageChannelOrAccount
 }