Forbid video deletion or ownership change for non-admin

1 files changed, 3 insertions, 0 deletions

diff --git a/server/controllers/api/videos/index.ts b/server/controllers/api/videos/index.ts
index e1c775180..1cbefc3e5 100644
--- a/server/controllers/api/videos/index.ts
+++ b/server/controllers/api/videos/index.ts
@@ -41,6 +41,7 @@ import {
   asyncMiddleware,
   asyncRetryTransactionMiddleware,
   authenticate,
+  ensureUserHasRight,
   checkVideoFollowConstraints,
   commonVideosFiltersValidator,
   optionalAuthenticate,
@@ -56,6 +57,7 @@ import {
   videosUpdateValidator
 } from '../../../middlewares'
 import { ScheduleVideoUpdateModel } from '../../../models/video/schedule-video-update'
+import { UserRight } from '../../../../shared'
 import { VideoModel } from '../../../models/video/video'
 import { VideoFileModel } from '../../../models/video/video-file'
 import { blacklistRouter } from './blacklist'
@@ -146,6 +148,7 @@ videosRouter.post('/:id/views',
 
 videosRouter.delete('/:id',
   authenticate,
+  ensureUserHasRight(UserRight.REMOVE_ANY_VIDEO),
   asyncMiddleware(videosRemoveValidator),
   asyncRetryTransactionMiddleware(removeVideo)
 )