X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Fmiddlewares%2Fvalidators%2Fvideos.ts;h=e3543ef9338c96c37f33592b0779352c9041a85e;hb=d5b7d9110dd637a7f67ce9e430145314812a8df1;hp=bffc5032256273ff55c24c3eaf60ac0314a36341;hpb=da854ddd502cd70685ef779c673b9e63757b8aa0;p=github%2FChocobozzz%2FPeerTube.git

diff --git a/server/middlewares/validators/videos.ts b/server/middlewares/validators/videos.ts
index bffc50322..e3543ef93 100644
--- a/server/middlewares/validators/videos.ts
+++ b/server/middlewares/validators/videos.ts
@@ -2,10 +2,20 @@ import * as express from 'express'
 import 'express-validator'
 import { body, param, query } from 'express-validator/check'
 import { UserRight, VideoPrivacy } from '../../../shared'
-import { isIdOrUUIDValid, isIdValid } from '../../helpers/custom-validators/misc'
+import { isBooleanValid, isIdOrUUIDValid, isIdValid, isUUIDValid } from '../../helpers/custom-validators/misc'
 import {
-  isVideoAbuseReasonValid, isVideoCategoryValid, isVideoDescriptionValid, isVideoExist, isVideoFile, isVideoLanguageValid,
-  isVideoLicenceValid, isVideoNameValid, isVideoNSFWValid, isVideoPrivacyValid, isVideoRatingTypeValid, isVideoTagsValid
+  isVideoAbuseReasonValid,
+  isVideoCategoryValid,
+  isVideoDescriptionValid,
+  isVideoExist,
+  isVideoFile,
+  isVideoImage,
+  isVideoLanguageValid,
+  isVideoLicenceValid,
+  isVideoNameValid,
+  isVideoPrivacyValid,
+  isVideoRatingTypeValid, isVideoSupportValid,
+  isVideoTagsValid
 } from '../../helpers/custom-validators/videos'
 import { getDurationFromVideoFile } from '../../helpers/ffmpeg-utils'
 import { logger } from '../../helpers/logger'
@@ -22,20 +32,31 @@ const videosAddValidator = [
     'This file is not supported. Please, make sure it is of the following type : '
     + CONSTRAINTS_FIELDS.VIDEOS.EXTNAME.join(', ')
   ),
+  body('thumbnailfile').custom((value, { req }) => isVideoImage(req.files, 'thumbnailfile')).withMessage(
+    'This thumbnail file is not supported. Please, make sure it is of the following type : '
+    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
+  ),
+  body('previewfile').custom((value, { req }) => isVideoImage(req.files, 'previewfile')).withMessage(
+    'This preview file is not supported. Please, make sure it is of the following type : '
+    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
+  ),
   body('name').custom(isVideoNameValid).withMessage('Should have a valid name'),
   body('category').optional().custom(isVideoCategoryValid).withMessage('Should have a valid category'),
   body('licence').optional().custom(isVideoLicenceValid).withMessage('Should have a valid licence'),
   body('language').optional().custom(isVideoLanguageValid).withMessage('Should have a valid language'),
-  body('nsfw').custom(isVideoNSFWValid).withMessage('Should have a valid NSFW attribute'),
+  body('nsfw').custom(isBooleanValid).withMessage('Should have a valid NSFW attribute'),
   body('description').optional().custom(isVideoDescriptionValid).withMessage('Should have a valid description'),
+  body('support').optional().custom(isVideoSupportValid).withMessage('Should have a valid support text'),
   body('channelId').custom(isIdValid).withMessage('Should have correct video channel id'),
   body('privacy').custom(isVideoPrivacyValid).withMessage('Should have correct video privacy'),
   body('tags').optional().custom(isVideoTagsValid).withMessage('Should have correct tags'),
+  body('commentsEnabled').custom(isBooleanValid).withMessage('Should have comments enabled boolean'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking videosAdd parameters', { parameters: req.body, files: req.files })
 
     if (areValidationErrors(req, res)) return
+    if (areErrorsInVideoImageFiles(req, res)) return
 
     const videoFile: Express.Multer.File = req.files['videofile'][0]
     const user = res.locals.oauth.token.User
@@ -65,7 +86,7 @@ const videosAddValidator = [
     try {
       duration = await getDurationFromVideoFile(videoFile.path)
     } catch (err) {
-      logger.error('Invalid input file in videosAddValidator.', err)
+      logger.error('Invalid input file in videosAddValidator.', { err })
       res.status(400)
          .json({ error: 'Invalid input file.' })
          .end()
@@ -81,35 +102,36 @@ const videosAddValidator = [
 
 const videosUpdateValidator = [
   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
+  body('thumbnailfile').custom((value, { req }) => isVideoImage(req.files, 'thumbnailfile')).withMessage(
+    'This thumbnail file is not supported. Please, make sure it is of the following type : '
+    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
+  ),
+  body('previewfile').custom((value, { req }) => isVideoImage(req.files, 'previewfile')).withMessage(
+    'This preview file is not supported. Please, make sure it is of the following type : '
+    + CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
+  ),
   body('name').optional().custom(isVideoNameValid).withMessage('Should have a valid name'),
   body('category').optional().custom(isVideoCategoryValid).withMessage('Should have a valid category'),
   body('licence').optional().custom(isVideoLicenceValid).withMessage('Should have a valid licence'),
   body('language').optional().custom(isVideoLanguageValid).withMessage('Should have a valid language'),
-  body('nsfw').optional().custom(isVideoNSFWValid).withMessage('Should have a valid NSFW attribute'),
+  body('nsfw').optional().custom(isBooleanValid).withMessage('Should have a valid NSFW attribute'),
   body('privacy').optional().custom(isVideoPrivacyValid).withMessage('Should have correct video privacy'),
   body('description').optional().custom(isVideoDescriptionValid).withMessage('Should have a valid description'),
+  body('support').optional().custom(isVideoSupportValid).withMessage('Should have a valid support text'),
   body('tags').optional().custom(isVideoTagsValid).withMessage('Should have correct tags'),
+  body('commentsEnabled').optional().custom(isBooleanValid).withMessage('Should have comments enabled boolean'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking videosUpdate parameters', { parameters: req.body })
 
     if (areValidationErrors(req, res)) return
+    if (areErrorsInVideoImageFiles(req, res)) return
     if (!await isVideoExist(req.params.id, res)) return
 
     const video = res.locals.video
 
-    // We need to make additional checks
-    if (video.isOwned() === false) {
-      return res.status(403)
-                .json({ error: 'Cannot update video of another server' })
-                .end()
-    }
-
-    if (video.VideoChannel.Account.userId !== res.locals.oauth.token.User.id) {
-      return res.status(403)
-                .json({ error: 'Cannot update video of another user' })
-                .end()
-    }
+    // Check if the user who did the request is able to update the video
+    if (!checkUserCanManageVideo(res.locals.oauth.token.User, res.locals.video, UserRight.UPDATE_ANY_VIDEO, res)) return
 
     if (video.privacy !== VideoPrivacy.PRIVATE && req.body.privacy === VideoPrivacy.PRIVATE) {
       return res.status(409)
@@ -132,9 +154,18 @@ const videosGetValidator = [
 
     const video = res.locals.video
 
-    // Video is not private, anyone can access it
-    if (video.privacy !== VideoPrivacy.PRIVATE) return next()
+    // Video is public, anyone can access it
+    if (video.privacy === VideoPrivacy.PUBLIC) return next()
+
+    // Video is unlisted, check we used the uuid to fetch it
+    if (video.privacy === VideoPrivacy.UNLISTED) {
+      if (isUUIDValid(req.params.id)) return next()
+
+      // Don't leak this unlisted video
+      return res.status(404).end()
+    }
 
+    // Video is private, check the user
     authenticate(req, res, () => {
       if (video.VideoChannel.Account.userId !== res.locals.oauth.token.User.id) {
         return res.status(403)
@@ -157,7 +188,7 @@ const videosRemoveValidator = [
     if (!await isVideoExist(req.params.id, res)) return
 
     // Check if the user who did the request is able to delete the video
-    if (!checkUserCanDeleteVideo(res.locals.oauth.token.User, res.locals.video, res)) return
+    if (!checkUserCanManageVideo(res.locals.oauth.token.User, res.locals.video, UserRight.REMOVE_ANY_VIDEO, res)) return
 
     return next()
   }
@@ -241,7 +272,7 @@ export {
 
 // ---------------------------------------------------------------------------
 
-function checkUserCanDeleteVideo (user: UserModel, video: VideoModel, res: express.Response) {
+function checkUserCanManageVideo (user: UserModel, video: VideoModel, right: UserRight, res: express.Response) {
   // Retrieve the user who did the request
   if (video.isOwned() === false) {
     res.status(403)
@@ -251,10 +282,10 @@ function checkUserCanDeleteVideo (user: UserModel, video: VideoModel, res: expre
   }
 
   // Check if the user can delete the video
-  // The user can delete it if s/he is an admin
+  // The user can delete it if he has the right
   // Or if s/he is the video's account
   const account = video.VideoChannel.Account
-  if (user.hasRight(UserRight.REMOVE_ANY_VIDEO) === false && account.userId !== user.id) {
+  if (user.hasRight(right) === false && account.userId !== user.id) {
     res.status(403)
               .json({ error: 'Cannot remove video of another user' })
               .end()
@@ -263,3 +294,22 @@ function checkUserCanDeleteVideo (user: UserModel, video: VideoModel, res: expre
 
   return true
 }
+
+function areErrorsInVideoImageFiles (req: express.Request, res: express.Response) {
+  // Files are optional
+  if (!req.files) return false
+
+  for (const imageField of [ 'thumbnail', 'preview' ]) {
+    if (!req.files[ imageField ]) continue
+
+    const imageFile = req.files[ imageField ][ 0 ] as Express.Multer.File
+    if (imageFile.size > CONSTRAINTS_FIELDS.VIDEOS.IMAGE.FILE_SIZE.max) {
+      res.status(400)
+        .send({ error: `The size of the ${imageField} is too big (>${CONSTRAINTS_FIELDS.VIDEOS.IMAGE.FILE_SIZE.max}).` })
+        .end()
+      return true
+    }
+  }
+
+  return false
+}