aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/controllers/api/videos/update.ts
diff options
context:
space:
mode:
authorChocobozzz <me@florianbigard.com>2022-11-15 14:41:55 +0100
committerChocobozzz <me@florianbigard.com>2022-11-15 14:41:55 +0100
commit4638cd713dcdd007cd7f49b9a95fa62ac7823e7c (patch)
tree3e341c6ebbd1ce9e2bbacd72e7e3793e0bd467c2 /server/controllers/api/videos/update.ts
parent6bcb559fc9a491fc3ce83e7c077ee9dc742b1d63 (diff)
downloadPeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.gz
PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.tar.zst
PeerTube-4638cd713dcdd007cd7f49b9a95fa62ac7823e7c.zip
Don't inject untrusted input
Even if it's already checked in middlewares It's better to have safe modals too
Diffstat (limited to 'server/controllers/api/videos/update.ts')
-rw-r--r--server/controllers/api/videos/update.ts3
1 files changed, 2 insertions, 1 deletions
diff --git a/server/controllers/api/videos/update.ts b/server/controllers/api/videos/update.ts
index 0a910379a..260dee2b9 100644
--- a/server/controllers/api/videos/update.ts
+++ b/server/controllers/api/videos/update.ts
@@ -19,6 +19,7 @@ import { asyncMiddleware, asyncRetryTransactionMiddleware, authenticate, videosU
19import { ScheduleVideoUpdateModel } from '../../../models/video/schedule-video-update' 19import { ScheduleVideoUpdateModel } from '../../../models/video/schedule-video-update'
20import { VideoModel } from '../../../models/video/video' 20import { VideoModel } from '../../../models/video/video'
21import { VideoPathManager } from '@server/lib/video-path-manager' 21import { VideoPathManager } from '@server/lib/video-path-manager'
22import { forceNumber } from '@shared/core-utils'
22 23
23const lTags = loggerTagsFactory('api', 'video') 24const lTags = loggerTagsFactory('api', 'video')
24const auditLogger = auditLoggerFactory('videos') 25const auditLogger = auditLoggerFactory('videos')
@@ -174,7 +175,7 @@ async function updateVideoPrivacy (options: {
174 const { videoInstance, videoInfoToUpdate, hadPrivacyForFederation, transaction } = options 175 const { videoInstance, videoInfoToUpdate, hadPrivacyForFederation, transaction } = options
175 const isNewVideo = videoInstance.isNewVideo(videoInfoToUpdate.privacy) 176 const isNewVideo = videoInstance.isNewVideo(videoInfoToUpdate.privacy)
176 177
177 const newPrivacy = parseInt(videoInfoToUpdate.privacy.toString(), 10) 178 const newPrivacy = forceNumber(videoInfoToUpdate.privacy)
178 setVideoPrivacy(videoInstance, newPrivacy) 179 setVideoPrivacy(videoInstance, newPrivacy)
179 180
180 // Unfederate the video if the new privacy is not compatible with federation 181 // Unfederate the video if the new privacy is not compatible with federation