X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Fmiddlewares%2Fvalidators%2Fvideos.ts;h=a2c8661522a21994061267fa359225dabc819e98;hb=d9eaee3939bf2e93e5d775d32bce77842201faba;hp=6d4fb907bab304226443f375805bb000018cb53a;hpb=ac81d1a06d57b9ae86663831e7f5edcef57b0fa4;p=github%2FChocobozzz%2FPeerTube.git

diff --git a/server/middlewares/validators/videos.ts b/server/middlewares/validators/videos.ts
index 6d4fb907b..a2c866152 100644
--- a/server/middlewares/validators/videos.ts
+++ b/server/middlewares/validators/videos.ts
@@ -1,11 +1,21 @@
 import * as express from 'express'
 import 'express-validator'
-import { body, param, query } from 'express-validator/check'
+import { body, param, ValidationChain } from 'express-validator/check'
 import { UserRight, VideoPrivacy } from '../../../shared'
-import { isBooleanValid, isIdOrUUIDValid, isIdValid, isUUIDValid } from '../../helpers/custom-validators/misc'
 import {
-  isVideoAbuseReasonValid,
+  isBooleanValid,
+  isDateValid,
+  isIdOrUUIDValid,
+  isIdValid,
+  isUUIDValid,
+  toIntOrNull,
+  toValueOrNull
+} from '../../helpers/custom-validators/misc'
+import {
+  checkUserCanManageVideo,
+  isScheduleVideoUpdatePrivacyValid,
   isVideoCategoryValid,
+  isVideoChannelOfAccountExist,
   isVideoDescriptionValid,
   isVideoExist,
   isVideoFile,
@@ -15,61 +25,40 @@ import {
   isVideoNameValid,
   isVideoPrivacyValid,
   isVideoRatingTypeValid,
+  isVideoSupportValid,
   isVideoTagsValid
 } from '../../helpers/custom-validators/videos'
 import { getDurationFromVideoFile } from '../../helpers/ffmpeg-utils'
 import { logger } from '../../helpers/logger'
 import { CONSTRAINTS_FIELDS } from '../../initializers'
-import { UserModel } from '../../models/account/user'
-import { VideoModel } from '../../models/video/video'
-import { VideoChannelModel } from '../../models/video/video-channel'
 import { VideoShareModel } from '../../models/video/video-share'
 import { authenticate } from '../oauth'
 import { areValidationErrors } from './utils'
+import { cleanUpReqFiles } from '../../helpers/express-utils'
+import { VideoModel } from '../../models/video/video'
+import { UserModel } from '../../models/account/user'
 
-const videosAddValidator = [
-  body('videofile').custom((value, { req }) => isVideoFile(req.files)).withMessage(
-    'This file is not supported. Please, make sure it is of the following type : '
-    + CONSTRAINTS_FIELDS.VIDEOS.EXTNAME.join(', ')
-  ),
-  body('thumbnailfile').custom((value, { req }) => isVideoImage(req.files, 'thumbnailfile')).withMessage(
-    'This thumbnail file is not supported. Please, make sure it is of the following type : '
-    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
-  ),
-  body('previewfile').custom((value, { req }) => isVideoImage(req.files, 'previewfile')).withMessage(
-    'This preview file is not supported. Please, make sure it is of the following type : '
-    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
-  ),
+const videosAddValidator = getCommonVideoAttributes().concat([
+  body('videofile')
+    .custom((value, { req }) => isVideoFile(req.files)).withMessage(
+      'This file is not supported or too large. Please, make sure it is of the following type: '
+      + CONSTRAINTS_FIELDS.VIDEOS.EXTNAME.join(', ')
+    ),
   body('name').custom(isVideoNameValid).withMessage('Should have a valid name'),
-  body('category').optional().custom(isVideoCategoryValid).withMessage('Should have a valid category'),
-  body('licence').optional().custom(isVideoLicenceValid).withMessage('Should have a valid licence'),
-  body('language').optional().custom(isVideoLanguageValid).withMessage('Should have a valid language'),
-  body('nsfw').custom(isBooleanValid).withMessage('Should have a valid NSFW attribute'),
-  body('description').optional().custom(isVideoDescriptionValid).withMessage('Should have a valid description'),
-  body('channelId').custom(isIdValid).withMessage('Should have correct video channel id'),
-  body('privacy').custom(isVideoPrivacyValid).withMessage('Should have correct video privacy'),
-  body('tags').optional().custom(isVideoTagsValid).withMessage('Should have correct tags'),
-  body('commentsEnabled').custom(isBooleanValid).withMessage('Should have comments enabled boolean'),
+  body('channelId')
+    .toInt()
+    .custom(isIdValid).withMessage('Should have correct video channel id'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking videosAdd parameters', { parameters: req.body, files: req.files })
 
-    if (areValidationErrors(req, res)) return
-    if (areErrorsInVideoImageFiles(req, res)) return
+    if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
+    if (areErrorsInScheduleUpdate(req, res)) return cleanUpReqFiles(req)
 
     const videoFile: Express.Multer.File = req.files['videofile'][0]
     const user = res.locals.oauth.token.User
 
-    const videoChannel = await VideoChannelModel.loadByIdAndAccount(req.body.channelId, user.Account.id)
-    if (!videoChannel) {
-      res.status(400)
-        .json({ error: 'Unknown video video channel for this account.' })
-        .end()
-
-      return
-    }
-
-    res.locals.videoChannel = videoChannel
+    if (!await isVideoChannelOfAccountExist(req.body.channelId, user, res)) return cleanUpReqFiles(req)
 
     const isAble = await user.isAbleToUploadVideo(videoFile)
     if (isAble === false) {
@@ -77,7 +66,7 @@ const videosAddValidator = [
          .json({ error: 'The user video quota is exceeded with this video.' })
          .end()
 
-      return
+      return cleanUpReqFiles(req)
     }
 
     let duration: number
@@ -85,71 +74,55 @@ const videosAddValidator = [
     try {
       duration = await getDurationFromVideoFile(videoFile.path)
     } catch (err) {
-      logger.error('Invalid input file in videosAddValidator.', err)
+      logger.error('Invalid input file in videosAddValidator.', { err })
       res.status(400)
          .json({ error: 'Invalid input file.' })
          .end()
 
-      return
+      return cleanUpReqFiles(req)
     }
 
     videoFile['duration'] = duration
 
     return next()
   }
-]
+])
 
-const videosUpdateValidator = [
+const videosUpdateValidator = getCommonVideoAttributes().concat([
   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
-  body('thumbnailfile').custom((value, { req }) => isVideoImage(req.files, 'thumbnailfile')).withMessage(
-    'This thumbnail file is not supported. Please, make sure it is of the following type : '
-    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
-  ),
-  body('previewfile').custom((value, { req }) => isVideoImage(req.files, 'previewfile')).withMessage(
-    'This preview file is not supported. Please, make sure it is of the following type : '
-    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
-  ),
-  body('name').optional().custom(isVideoNameValid).withMessage('Should have a valid name'),
-  body('category').optional().custom(isVideoCategoryValid).withMessage('Should have a valid category'),
-  body('licence').optional().custom(isVideoLicenceValid).withMessage('Should have a valid licence'),
-  body('language').optional().custom(isVideoLanguageValid).withMessage('Should have a valid language'),
-  body('nsfw').optional().custom(isBooleanValid).withMessage('Should have a valid NSFW attribute'),
-  body('privacy').optional().custom(isVideoPrivacyValid).withMessage('Should have correct video privacy'),
-  body('description').optional().custom(isVideoDescriptionValid).withMessage('Should have a valid description'),
-  body('tags').optional().custom(isVideoTagsValid).withMessage('Should have correct tags'),
-  body('commentsEnabled').optional().custom(isBooleanValid).withMessage('Should have comments enabled boolean'),
+  body('name')
+    .optional()
+    .custom(isVideoNameValid).withMessage('Should have a valid name'),
+  body('channelId')
+    .optional()
+    .toInt()
+    .custom(isIdValid).withMessage('Should have correct video channel id'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking videosUpdate parameters', { parameters: req.body })
 
-    if (areValidationErrors(req, res)) return
-    if (areErrorsInVideoImageFiles(req, res)) return
-    if (!await isVideoExist(req.params.id, res)) return
+    if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
+    if (areErrorsInScheduleUpdate(req, res)) return cleanUpReqFiles(req)
+    if (!await isVideoExist(req.params.id, res)) return cleanUpReqFiles(req)
 
     const video = res.locals.video
 
-    // We need to make additional checks
-    if (video.isOwned() === false) {
-      return res.status(403)
-                .json({ error: 'Cannot update video of another server' })
-                .end()
-    }
-
-    if (video.VideoChannel.Account.userId !== res.locals.oauth.token.User.id) {
-      return res.status(403)
-                .json({ error: 'Cannot update video of another user' })
-                .end()
-    }
+    // Check if the user who did the request is able to update the video
+    const user = res.locals.oauth.token.User
+    if (!checkUserCanManageVideo(user, res.locals.video, UserRight.UPDATE_ANY_VIDEO, res)) return cleanUpReqFiles(req)
 
     if (video.privacy !== VideoPrivacy.PRIVATE && req.body.privacy === VideoPrivacy.PRIVATE) {
+      cleanUpReqFiles(req)
       return res.status(409)
-        .json({ error: 'Cannot set "private" a video that was not private anymore.' })
+        .json({ error: 'Cannot set "private" a video that was not private.' })
         .end()
     }
 
+    if (req.body.channelId && !await isVideoChannelOfAccountExist(req.body.channelId, user, res)) return cleanUpReqFiles(req)
+
     return next()
   }
-]
+])
 
 const videosGetValidator = [
   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
@@ -160,7 +133,25 @@ const videosGetValidator = [
     if (areValidationErrors(req, res)) return
     if (!await isVideoExist(req.params.id, res)) return
 
-    const video = res.locals.video
+    const video: VideoModel = res.locals.video
+
+    // Video private or blacklisted
+    if (video.privacy === VideoPrivacy.PRIVATE || video.VideoBlacklist) {
+      return authenticate(req, res, () => {
+        const user: UserModel = res.locals.oauth.token.User
+
+        // Only the owner or a user that have blacklist rights can see the video
+        if (video.VideoChannel.Account.userId !== user.id && !user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) {
+          return res.status(403)
+                    .json({ error: 'Cannot get this private or blacklisted video.' })
+                    .end()
+        }
+
+        return next()
+      })
+
+      return
+    }
 
     // Video is public, anyone can access it
     if (video.privacy === VideoPrivacy.PUBLIC) return next()
@@ -172,17 +163,6 @@ const videosGetValidator = [
       // Don't leak this unlisted video
       return res.status(404).end()
     }
-
-    // Video is private, check the user
-    authenticate(req, res, () => {
-      if (video.VideoChannel.Account.userId !== res.locals.oauth.token.User.id) {
-        return res.status(403)
-          .json({ error: 'Cannot get this private video of another user' })
-          .end()
-      }
-
-      return next()
-    })
   }
 ]
 
@@ -196,33 +176,7 @@ const videosRemoveValidator = [
     if (!await isVideoExist(req.params.id, res)) return
 
     // Check if the user who did the request is able to delete the video
-    if (!checkUserCanDeleteVideo(res.locals.oauth.token.User, res.locals.video, res)) return
-
-    return next()
-  }
-]
-
-const videosSearchValidator = [
-  query('search').not().isEmpty().withMessage('Should have a valid search'),
-
-  (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking videosSearch parameters', { parameters: req.params })
-
-    if (areValidationErrors(req, res)) return
-
-    return next()
-  }
-]
-
-const videoAbuseReportValidator = [
-  param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
-  body('reason').custom(isVideoAbuseReasonValid).withMessage('Should have a valid reason'),
-
-  async (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    logger.debug('Checking videoAbuseReport parameters', { parameters: req.body })
-
-    if (areValidationErrors(req, res)) return
-    if (!await isVideoExist(req.params.id, res)) return
+    if (!checkUserCanManageVideo(res.locals.oauth.token.User, res.locals.video, UserRight.REMOVE_ANY_VIDEO, res)) return
 
     return next()
   }
@@ -263,6 +217,73 @@ const videosShareValidator = [
   }
 ]
 
+function getCommonVideoAttributes () {
+  return [
+    body('thumbnailfile')
+      .custom((value, { req }) => isVideoImage(req.files, 'thumbnailfile')).withMessage(
+      'This thumbnail file is not supported or too large. Please, make sure it is of the following type: '
+      + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
+    ),
+    body('previewfile')
+      .custom((value, { req }) => isVideoImage(req.files, 'previewfile')).withMessage(
+      'This preview file is not supported or too large. Please, make sure it is of the following type: '
+      + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
+    ),
+
+    body('category')
+      .optional()
+      .customSanitizer(toIntOrNull)
+      .custom(isVideoCategoryValid).withMessage('Should have a valid category'),
+    body('licence')
+      .optional()
+      .customSanitizer(toIntOrNull)
+      .custom(isVideoLicenceValid).withMessage('Should have a valid licence'),
+    body('language')
+      .optional()
+      .customSanitizer(toValueOrNull)
+      .custom(isVideoLanguageValid).withMessage('Should have a valid language'),
+    body('nsfw')
+      .optional()
+      .toBoolean()
+      .custom(isBooleanValid).withMessage('Should have a valid NSFW attribute'),
+    body('waitTranscoding')
+      .optional()
+      .toBoolean()
+      .custom(isBooleanValid).withMessage('Should have a valid wait transcoding attribute'),
+    body('privacy')
+      .optional()
+      .toInt()
+      .custom(isVideoPrivacyValid).withMessage('Should have correct video privacy'),
+    body('description')
+      .optional()
+      .customSanitizer(toValueOrNull)
+      .custom(isVideoDescriptionValid).withMessage('Should have a valid description'),
+    body('support')
+      .optional()
+      .customSanitizer(toValueOrNull)
+      .custom(isVideoSupportValid).withMessage('Should have a valid support text'),
+    body('tags')
+      .optional()
+      .customSanitizer(toValueOrNull)
+      .custom(isVideoTagsValid).withMessage('Should have correct tags'),
+    body('commentsEnabled')
+      .optional()
+      .toBoolean()
+      .custom(isBooleanValid).withMessage('Should have comments enabled boolean'),
+
+    body('scheduleUpdate')
+      .optional()
+      .customSanitizer(toValueOrNull),
+    body('scheduleUpdate.updateAt')
+      .optional()
+      .custom(isDateValid).withMessage('Should have a valid schedule update date'),
+    body('scheduleUpdate.privacy')
+      .optional()
+      .toInt()
+      .custom(isScheduleVideoUpdatePrivacyValid).withMessage('Should have correct schedule update privacy')
+  ] as (ValidationChain | express.Handler)[]
+}
+
 // ---------------------------------------------------------------------------
 
 export {
@@ -270,51 +291,22 @@ export {
   videosUpdateValidator,
   videosGetValidator,
   videosRemoveValidator,
-  videosSearchValidator,
   videosShareValidator,
 
-  videoAbuseReportValidator,
+  videoRateValidator,
 
-  videoRateValidator
+  getCommonVideoAttributes
 }
 
 // ---------------------------------------------------------------------------
 
-function checkUserCanDeleteVideo (user: UserModel, video: VideoModel, res: express.Response) {
-  // Retrieve the user who did the request
-  if (video.isOwned() === false) {
-    res.status(403)
-              .json({ error: 'Cannot remove video of another server, blacklist it' })
-              .end()
-    return false
-  }
-
-  // Check if the user can delete the video
-  // The user can delete it if he has the right
-  // Or if s/he is the video's account
-  const account = video.VideoChannel.Account
-  if (user.hasRight(UserRight.REMOVE_ANY_VIDEO) === false && account.userId !== user.id) {
-    res.status(403)
-              .json({ error: 'Cannot remove video of another user' })
-              .end()
-    return false
-  }
-
-  return true
-}
-
-function areErrorsInVideoImageFiles (req: express.Request, res: express.Response) {
-  // Files are optional
-  if (!req.files) return false
-
-  for (const imageField of [ 'thumbnail', 'preview' ]) {
-    if (!req.files[ imageField ]) continue
-
-    const imageFile = req.files[ imageField ][ 0 ] as Express.Multer.File
-    if (imageFile.size > CONSTRAINTS_FIELDS.VIDEOS.IMAGE.FILE_SIZE.max) {
+function areErrorsInScheduleUpdate (req: express.Request, res: express.Response) {
+  if (req.body.scheduleUpdate) {
+    if (!req.body.scheduleUpdate.updateAt) {
       res.status(400)
-        .send({ error: `The size of the ${imageField} is too big (>${CONSTRAINTS_FIELDS.VIDEOS.IMAGE.FILE_SIZE.max}).` })
-        .end()
+         .json({ error: 'Schedule update at is mandatory.' })
+         .end()
+
       return true
     }
   }