Limit channel numbers

We can't load too much channels in selects and it helps to prevent actor
name squatting

diff --git a/server/initializers/constants.ts b/server/initializers/constants.ts
index a1538f3ca77b39bbb2a59915b74e2312b5c8a813..0473b48c021d0a2657cdf8023fa117660e16fe84 100644 (file)
--- a/server/initializers/constants.ts
+++ b/server/initializers/constants.ts
@@ -431,6 +431,10 @@ const OVERVIEWS = {
   }
 }
 
+const VIDEO_CHANNELS = {
+  MAX_PER_USER: 20
+}
+
 // ---------------------------------------------------------------------------
 
 const SERVER_ACTOR_NAME = 'peertube'
@@ -725,6 +729,7 @@ export {
   VIDEO_TRANSCODING_FPS,
   FFMPEG_NICE,
   VIDEO_ABUSE_STATES,
+  VIDEO_CHANNELS,
   LRU_CACHE,
   JOB_REQUEST_TIMEOUT,
   USER_PASSWORD_RESET_LIFETIME,

diff --git a/server/middlewares/validators/videos/video-channels.ts b/server/middlewares/validators/videos/video-channels.ts
index d212745277336b650f5cf12ee9d265b7e7fdb3a5..ce2d61d493005aa8aeb85853c25b3685f2b67efe 100644 (file)
--- a/server/middlewares/validators/videos/video-channels.ts
+++ b/server/middlewares/validators/videos/video-channels.ts
@@ -14,6 +14,7 @@ import { ActorModel } from '../../../models/activitypub/actor'
 import { isBooleanValid } from '../../../helpers/custom-validators/misc'
 import { doesLocalVideoChannelNameExist, doesVideoChannelNameWithHostExist } from '../../../helpers/middlewares'
 import { MChannelAccountDefault, MUser } from '@server/typings/models'
+import { VIDEO_CHANNELS } from '@server/initializers/constants'
 
 const videoChannelsAddValidator = [
   body('name').custom(isActorPreferredUsernameValid).withMessage('Should have a valid channel name'),
@@ -34,6 +35,14 @@ const videoChannelsAddValidator = [
       return false
     }
 
+    const count = await VideoChannelModel.countByAccount(res.locals.oauth.token.User.Account.id)
+    if (count > VIDEO_CHANNELS.MAX_PER_USER) {
+      res.status(400)
+        .send({ error: `You cannot create more than ${VIDEO_CHANNELS.MAX_PER_USER} channels` })
+        .end()
+      return false
+    }
+
     return next()
   }
 ]