Prevent caption listing of private videos

2 files changed, 4 insertions, 2 deletions

diff --git a/server/controllers/api/videos/captions.ts b/server/controllers/api/videos/captions.ts
index 2d2213327..aa7259ee9 100644
--- a/server/controllers/api/videos/captions.ts
+++ b/server/controllers/api/videos/captions.ts
@@ -48,7 +48,7 @@ export {
 // ---------------------------------------------------------------------------
 
 async function listVideoCaptions (req: express.Request, res: express.Response) {
-  const data = await VideoCaptionModel.listVideoCaptions(res.locals.videoId.id)
+  const data = await VideoCaptionModel.listVideoCaptions(res.locals.onlyVideo.id)
 
   return res.json(getFormattedObjects(data, data.length))
 }
diff --git a/server/controllers/api/videos/files.ts b/server/controllers/api/videos/files.ts
index a8b32411d..0fbda280e 100644
--- a/server/controllers/api/videos/files.ts
+++ b/server/controllers/api/videos/files.ts
@@ -10,13 +10,15 @@ import {
   ensureUserHasRight,
   videoFileMetadataGetValidator,
   videoFilesDeleteHLSValidator,
-  videoFilesDeleteWebTorrentValidator
+  videoFilesDeleteWebTorrentValidator,
+  videosGetValidator
 } from '../../../middlewares'
 
 const lTags = loggerTagsFactory('api', 'video')
 const filesRouter = express.Router()
 
 filesRouter.get('/:id/metadata/:videoFileId',
+  asyncMiddleware(videosGetValidator),
   asyncMiddleware(videoFileMetadataGetValidator),
   asyncMiddleware(getVideoFileMetadata)
 )