aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/middlewares/validators
diff options
context:
space:
mode:
authorChocobozzz <me@florianbigard.com>2019-12-12 15:47:47 +0100
committerChocobozzz <me@florianbigard.com>2019-12-12 16:51:59 +0100
commit22a73cb879a5cc775d4bec3d72fa9c9cf52e5175 (patch)
tree4c8d2d4f6fce8a520420ec83722fefc6d57b7a83 /server/middlewares/validators
parent91fa7960f42cff3481465bece3389007fbc278d3 (diff)
downloadPeerTube-22a73cb879a5cc775d4bec3d72fa9c9cf52e5175.tar.gz
PeerTube-22a73cb879a5cc775d4bec3d72fa9c9cf52e5175.tar.zst
PeerTube-22a73cb879a5cc775d4bec3d72fa9c9cf52e5175.zip
Add internal privacy mode
Diffstat (limited to 'server/middlewares/validators')
-rw-r--r--server/middlewares/validators/videos/videos.ts9
1 files changed, 3 insertions, 6 deletions
diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts
index ab984d84a..5e0182cc3 100644
--- a/server/middlewares/validators/videos/videos.ts
+++ b/server/middlewares/validators/videos/videos.ts
@@ -161,18 +161,15 @@ const videosCustomGetValidator = (fetchType: 'all' | 'only-video' | 'only-video-
161 const videoAll = video as MVideoFullLight 161 const videoAll = video as MVideoFullLight
162 162
163 // Video private or blacklisted 163 // Video private or blacklisted
164 if (video.privacy === VideoPrivacy.PRIVATE || videoAll.VideoBlacklist) { 164 if (videoAll.requiresAuth()) {
165 await authenticatePromiseIfNeeded(req, res, authenticateInQuery) 165 await authenticatePromiseIfNeeded(req, res, authenticateInQuery)
166 166
167 const user = res.locals.oauth ? res.locals.oauth.token.User : null 167 const user = res.locals.oauth ? res.locals.oauth.token.User : null
168 168
169 // Only the owner or a user that have blacklist rights can see the video 169 // Only the owner or a user that have blacklist rights can see the video
170 if ( 170 if (!user || !user.canGetVideo(videoAll)) {
171 !user ||
172 (videoAll.VideoChannel && videoAll.VideoChannel.Account.userId !== user.id && !user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST))
173 ) {
174 return res.status(403) 171 return res.status(403)
175 .json({ error: 'Cannot get this private or blacklisted video.' }) 172 .json({ error: 'Cannot get this private/internal or blacklisted video.' })
176 } 173 }
177 174
178 return next() 175 return next()