Forbid video deletion or ownership change for non-admin

diff --git a/client/src/app/+my-library/my-videos/my-videos.component.html b/client/src/app/+my-library/my-videos/my-videos.component.html
index 977f7b03b2cd78cf4fd3894f7e2babb8b2b9d49b..7f9fc9de85e9a4be8cfa698cb20dc909d56d6d1f 100644 (file)
--- a/client/src/app/+my-library/my-videos/my-videos.component.html
+++ b/client/src/app/+my-library/my-videos/my-videos.component.html
@@ -38,10 +38,6 @@
   #videosSelection
 >
   <ng-template ptTemplate="globalButtons">
-    <span class="action-button action-button-delete-selection" (click)="deleteSelectedVideos()">
-      <my-global-icon iconName="delete" aria-hidden="true"></my-global-icon>
-      <ng-container i18n>Delete</ng-container>
-    </span>
   </ng-template>
 
   <ng-template ptTemplate="rowButtons" let-video>

diff --git a/client/src/app/+my-library/my-videos/my-videos.component.ts b/client/src/app/+my-library/my-videos/my-videos.component.ts
index e89bb12e1655be600b744cd2ae7eaeb25a88a4fe..990f85693758674783f6637c2bbbe91dfc5391a8 100644 (file)
--- a/client/src/app/+my-library/my-videos/my-videos.component.ts
+++ b/client/src/app/+my-library/my-videos/my-videos.component.ts
@@ -162,16 +162,6 @@ export class MyVideosComponent implements OnInit, DisableForReuseHook {
         handler: ({ video }) => this.displayLiveInformation(video),
         isDisplayed: ({ video }) => video.isLive,
         iconName: 'live'
-      },
-      {
-        label: $localize`Change ownership`,
-        handler: ({ video }) => this.changeOwnership(video),
-        iconName: 'ownership-change'
-      },
-      {
-        label: $localize`Delete`,
-        handler: ({ video }) => this.deleteVideo(video),
-        iconName: 'delete'
       }
     ]
   }

diff --git a/client/src/app/shared/shared-main/video/video.model.ts b/client/src/app/shared/shared-main/video/video.model.ts
index adb6e884f16c2066a2c6f9a9b31408807334b578..d51dfbc6d485917619655e5b53dbbaf46e6a1315 100644 (file)
--- a/client/src/app/shared/shared-main/video/video.model.ts
+++ b/client/src/app/shared/shared-main/video/video.model.ts
@@ -180,7 +180,7 @@ export class Video implements VideoServerModel {
   }
 
   isRemovableBy (user: AuthUser) {
-    return user && this.isLocal === true && (this.account.name === user.username || user.hasRight(UserRight.REMOVE_ANY_VIDEO))
+    return user && this.isLocal === true && user.hasRight(UserRight.REMOVE_ANY_VIDEO)
   }
 
   isBlockableBy (user: AuthUser) {

diff --git a/server/controllers/api/videos/index.ts b/server/controllers/api/videos/index.ts
index e1c775180c89831d549a66165711f611cbbb6dcd..1cbefc3e5eea9a31168992c9e98ba7bee8a2a18c 100644 (file)
--- a/server/controllers/api/videos/index.ts
+++ b/server/controllers/api/videos/index.ts
@@ -41,6 +41,7 @@ import {
   asyncMiddleware,
   asyncRetryTransactionMiddleware,
   authenticate,
+  ensureUserHasRight,
   checkVideoFollowConstraints,
   commonVideosFiltersValidator,
   optionalAuthenticate,
@@ -56,6 +57,7 @@ import {
   videosUpdateValidator
 } from '../../../middlewares'
 import { ScheduleVideoUpdateModel } from '../../../models/video/schedule-video-update'
+import { UserRight } from '../../../../shared'
 import { VideoModel } from '../../../models/video/video'
 import { VideoFileModel } from '../../../models/video/video-file'
 import { blacklistRouter } from './blacklist'
@@ -146,6 +148,7 @@ videosRouter.post('/:id/views',
 
 videosRouter.delete('/:id',
   authenticate,
+  ensureUserHasRight(UserRight.REMOVE_ANY_VIDEO),
   asyncMiddleware(videosRemoveValidator),
   asyncRetryTransactionMiddleware(removeVideo)
 )