diff options
author | Chocobozzz <me@florianbigard.com> | 2022-01-06 13:27:29 +0100 |
---|---|---|
committer | Chocobozzz <me@florianbigard.com> | 2022-01-06 13:27:29 +0100 |
commit | 795212f7acc690c88c86d0fab8772f6564d59cb8 (patch) | |
tree | 3a0203fc1957fd8cf8876774051137a0b04236fc /server/middlewares/validators/videos/videos.ts | |
parent | 7b54a81cccf6b4c12269e9d6897d608b1a99537a (diff) | |
download | PeerTube-795212f7acc690c88c86d0fab8772f6564d59cb8.tar.gz PeerTube-795212f7acc690c88c86d0fab8772f6564d59cb8.tar.zst PeerTube-795212f7acc690c88c86d0fab8772f6564d59cb8.zip |
Prevent caption listing of private videos
Diffstat (limited to 'server/middlewares/validators/videos/videos.ts')
-rw-r--r-- | server/middlewares/validators/videos/videos.ts | 19 |
1 files changed, 6 insertions, 13 deletions
diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts index 3ebdbc33d..782f495e8 100644 --- a/server/middlewares/validators/videos/videos.ts +++ b/server/middlewares/validators/videos/videos.ts | |||
@@ -51,9 +51,9 @@ import { CONSTRAINTS_FIELDS, OVERVIEWS } from '../../../initializers/constants' | |||
51 | import { isLocalVideoAccepted } from '../../../lib/moderation' | 51 | import { isLocalVideoAccepted } from '../../../lib/moderation' |
52 | import { Hooks } from '../../../lib/plugins/hooks' | 52 | import { Hooks } from '../../../lib/plugins/hooks' |
53 | import { VideoModel } from '../../../models/video/video' | 53 | import { VideoModel } from '../../../models/video/video' |
54 | import { authenticatePromiseIfNeeded } from '../../auth' | ||
55 | import { | 54 | import { |
56 | areValidationErrors, | 55 | areValidationErrors, |
56 | checkCanSeePrivateVideo, | ||
57 | checkUserCanManageVideo, | 57 | checkUserCanManageVideo, |
58 | doesVideoChannelOfAccountExist, | 58 | doesVideoChannelOfAccountExist, |
59 | doesVideoExist, | 59 | doesVideoExist, |
@@ -317,19 +317,12 @@ const videosCustomGetValidator = ( | |||
317 | 317 | ||
318 | // Video private or blacklisted | 318 | // Video private or blacklisted |
319 | if (video.requiresAuth()) { | 319 | if (video.requiresAuth()) { |
320 | await authenticatePromiseIfNeeded(req, res, authenticateInQuery) | 320 | if (await checkCanSeePrivateVideo(req, res, video, authenticateInQuery)) return next() |
321 | 321 | ||
322 | const user = res.locals.oauth ? res.locals.oauth.token.User : null | 322 | return res.fail({ |
323 | 323 | status: HttpStatusCode.FORBIDDEN_403, | |
324 | // Only the owner or a user that have blocklist rights can see the video | 324 | message: 'Cannot get this private/internal or blocklisted video' |
325 | if (!user || !user.canGetVideo(video)) { | 325 | }) |
326 | return res.fail({ | ||
327 | status: HttpStatusCode.FORBIDDEN_403, | ||
328 | message: 'Cannot get this private/internal or blocklisted video' | ||
329 | }) | ||
330 | } | ||
331 | |||
332 | return next() | ||
333 | } | 326 | } |
334 | 327 | ||
335 | // Video is public, anyone can access it | 328 | // Video is public, anyone can access it |