Check channel sync id is owned by channel

1 files changed, 7 insertions, 0 deletions

diff --git a/server/middlewares/validators/videos/video-channels.ts b/server/middlewares/validators/videos/video-channels.ts
index 8338b24fc..ca6b57003 100644
--- a/server/middlewares/validators/videos/video-channels.ts
+++ b/server/middlewares/validators/videos/video-channels.ts
@@ -166,6 +166,13 @@ export const videoChannelImportVideosValidator = [
 
     if (body.videoChannelSyncId && !await doesVideoChannelSyncIdExist(body.videoChannelSyncId, res)) return
 
+    if (res.locals.videoChannelSync && res.locals.videoChannelSync.videoChannelId !== res.locals.videoChannel.id) {
+      return res.fail({
+        status: HttpStatusCode.FORBIDDEN_403,
+        message: 'This channel sync is not owned by this channel'
+      })
+    }
+
     return next()
   }
 ]