aboutsummaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
-rw-r--r--middlewares/index.js53
-rw-r--r--middlewares/misc.js57
-rw-r--r--routes/api/v1/pods.js9
-rw-r--r--routes/api/v1/remoteVideos.js7
-rw-r--r--routes/api/v1/videos.js13
-rw-r--r--routes/views.js2
6 files changed, 77 insertions, 64 deletions
diff --git a/middlewares/index.js b/middlewares/index.js
index 6368d791a..e727202ba 100644
--- a/middlewares/index.js
+++ b/middlewares/index.js
@@ -1,56 +1,9 @@
1;(function () { 1;(function () {
2 'use strict' 2 'use strict'
3 3
4 var ursa = require('ursa') 4 var middleware = {
5 var fs = require('fs') 5 reqValidators: require('./reqValidators'),
6 6 misc: require('./misc')
7 var logger = require('../src/logger')
8 var utils = require('../src/utils')
9 var PodsDB = require('../src/database').PodsDB
10
11 var middleware = {}
12
13 middleware.cache = function (cache) {
14 return function (req, res, next) {
15 // If we want explicitly a cache
16 // Or if we don't specify if we want a cache or no and we are in production
17 if (cache === true || (cache !== false && process.env.NODE_ENV === 'production')) {
18 res.setHeader('Cache-Control', 'public')
19 } else {
20 res.setHeader('Cache-Control', 'no-cache, no-store, max-age=0, must-revalidate')
21 }
22
23 next()
24 }
25 }
26
27 middleware.decryptBody = function (req, res, next) {
28 logger.debug('Decrypting body.')
29
30 PodsDB.findOne({ url: req.body.signature.url }, function (err, pod) {
31 if (err) {
32 logger.error('Cannot get signed url in decryptBody.', { error: err })
33 res.sendStatus(500)
34 }
35
36 logger.debug('Found one pod which could send the message.', { pod: pod.publicKey, url: req.body.signature.url })
37
38 var crt = ursa.createPublicKey(pod.publicKey)
39 var signature_ok = crt.hashAndVerify('sha256', new Buffer(req.body.signature.url).toString('hex'), req.body.signature.signature, 'hex')
40
41 if (signature_ok === true) {
42 var myKey = ursa.createPrivateKey(fs.readFileSync(utils.certDir + 'peertube.key.pem'))
43 var decryptedKey = myKey.decrypt(req.body.key, 'hex', 'utf8')
44 logger.debug(decryptedKey)
45 req.body.data = JSON.parse(utils.symetricDecrypt(req.body.data, decryptedKey))
46 logger.debug('Decrypted.', { body: req.body })
47 } else {
48 logger.error('Signature is not okay in decryptBody for %s.', req.body.signature.url)
49 res.sendStatus(500)
50 }
51
52 next()
53 })
54 } 7 }
55 8
56 module.exports = middleware 9 module.exports = middleware
diff --git a/middlewares/misc.js b/middlewares/misc.js
new file mode 100644
index 000000000..69e8d78c1
--- /dev/null
+++ b/middlewares/misc.js
@@ -0,0 +1,57 @@
1;(function () {
2 'use strict'
3
4 var ursa = require('ursa')
5 var fs = require('fs')
6
7 var logger = require('../src/logger')
8 var utils = require('../src/utils')
9 var PodsDB = require('../src/database').PodsDB
10
11 var misc = {}
12
13 misc.cache = function (cache) {
14 return function (req, res, next) {
15 // If we want explicitly a cache
16 // Or if we don't specify if we want a cache or no and we are in production
17 if (cache === true || (cache !== false && process.env.NODE_ENV === 'production')) {
18 res.setHeader('Cache-Control', 'public')
19 } else {
20 res.setHeader('Cache-Control', 'no-cache, no-store, max-age=0, must-revalidate')
21 }
22
23 next()
24 }
25 }
26
27 misc.decryptBody = function (req, res, next) {
28 logger.debug('Decrypting body.')
29
30 PodsDB.findOne({ url: req.body.signature.url }, function (err, pod) {
31 if (err) {
32 logger.error('Cannot get signed url in decryptBody.', { error: err })
33 res.sendStatus(500)
34 }
35
36 logger.debug('Found one pod which could send the message.', { pod: pod.publicKey, url: req.body.signature.url })
37
38 var crt = ursa.createPublicKey(pod.publicKey)
39 var signature_ok = crt.hashAndVerify('sha256', new Buffer(req.body.signature.url).toString('hex'), req.body.signature.signature, 'hex')
40
41 if (signature_ok === true) {
42 var myKey = ursa.createPrivateKey(fs.readFileSync(utils.certDir + 'peertube.key.pem'))
43 var decryptedKey = myKey.decrypt(req.body.key, 'hex', 'utf8')
44 logger.debug(decryptedKey)
45 req.body.data = JSON.parse(utils.symetricDecrypt(req.body.data, decryptedKey))
46 logger.debug('Decrypted.', { body: req.body })
47 } else {
48 logger.error('Signature is not okay in decryptBody for %s.', req.body.signature.url)
49 res.sendStatus(500)
50 }
51
52 next()
53 })
54 }
55
56 module.exports = misc
57})()
diff --git a/routes/api/v1/pods.js b/routes/api/v1/pods.js
index 8ae676834..2bb8f89ab 100644
--- a/routes/api/v1/pods.js
+++ b/routes/api/v1/pods.js
@@ -4,7 +4,8 @@
4 var express = require('express') 4 var express = require('express')
5 var router = express.Router() 5 var router = express.Router()
6 var middleware = require('../../../middlewares') 6 var middleware = require('../../../middlewares')
7 var reqValidator = require('../../../middlewares/reqValidators').pods 7 var miscMiddleware = middleware.misc
8 var reqValidator = middleware.reqValidators.pods
8 var pods = require('../../../src/pods') 9 var pods = require('../../../src/pods')
9 10
10 function listPods (req, res, next) { 11 function listPods (req, res, next) {
@@ -31,9 +32,9 @@
31 }) 32 })
32 } 33 }
33 34
34 router.get('/', middleware.cache(false), listPods) 35 router.get('/', miscMiddleware.cache(false), listPods)
35 router.get('/makefriends', middleware.cache(false), makeFriends) 36 router.get('/makefriends', miscMiddleware.cache(false), makeFriends)
36 router.post('/', reqValidator.podsAdd, middleware.cache(false), addPods) 37 router.post('/', reqValidator.podsAdd, miscMiddleware.cache(false), addPods)
37 38
38 module.exports = router 39 module.exports = router
39})() 40})()
diff --git a/routes/api/v1/remoteVideos.js b/routes/api/v1/remoteVideos.js
index 23bdcbe24..10793b2b4 100644
--- a/routes/api/v1/remoteVideos.js
+++ b/routes/api/v1/remoteVideos.js
@@ -4,7 +4,8 @@
4 var express = require('express') 4 var express = require('express')
5 var router = express.Router() 5 var router = express.Router()
6 var middleware = require('../../../middlewares') 6 var middleware = require('../../../middlewares')
7 var requestValidator = require('../../../middlewares/reqValidators').remote 7 var miscMiddleware = middleware.misc
8 var reqValidator = middleware.reqValidators.remote
8 var videos = require('../../../src/videos') 9 var videos = require('../../../src/videos')
9 10
10 function addRemoteVideos (req, res, next) { 11 function addRemoteVideos (req, res, next) {
@@ -23,8 +24,8 @@
23 }) 24 })
24 } 25 }
25 26
26 router.post('/add', requestValidator.secureRequest, middleware.decryptBody, requestValidator.remoteVideosAdd, middleware.cache(false), addRemoteVideos) 27 router.post('/add', reqValidator.secureRequest, miscMiddleware.decryptBody, reqValidator.remoteVideosAdd, miscMiddleware.cache(false), addRemoteVideos)
27 router.post('/remove', requestValidator.secureRequest, middleware.decryptBody, requestValidator.remoteVideosRemove, middleware.cache(false), removeRemoteVideo) 28 router.post('/remove', reqValidator.secureRequest, miscMiddleware.decryptBody, reqValidator.remoteVideosRemove, miscMiddleware.cache(false), removeRemoteVideo)
28 29
29 module.exports = router 30 module.exports = router
30})() 31})()
diff --git a/routes/api/v1/videos.js b/routes/api/v1/videos.js
index 06b248244..33c565437 100644
--- a/routes/api/v1/videos.js
+++ b/routes/api/v1/videos.js
@@ -4,7 +4,8 @@
4 var express = require('express') 4 var express = require('express')
5 var router = express.Router() 5 var router = express.Router()
6 var middleware = require('../../../middlewares') 6 var middleware = require('../../../middlewares')
7 var reqValidator = require('../../../middlewares/reqValidators').videos 7 var miscMiddleware = middleware.misc
8 var reqValidator = middleware.reqValidators.videos
8 var videos = require('../../../src/videos') 9 var videos = require('../../../src/videos')
9 10
10 function listVideos (req, res, next) { 11 function listVideos (req, res, next) {
@@ -52,11 +53,11 @@
52 }) 53 })
53 } 54 }
54 55
55 router.get('/', middleware.cache(false), listVideos) 56 router.get('/', miscMiddleware.cache(false), listVideos)
56 router.post('/', reqValidator.videosAdd, middleware.cache(false), addVideos) 57 router.post('/', reqValidator.videosAdd, miscMiddleware.cache(false), addVideos)
57 router.get('/search/:name', reqValidator.videosSearch, middleware.cache(false), searchVideos) 58 router.get('/search/:name', reqValidator.videosSearch, miscMiddleware.cache(false), searchVideos)
58 router.get('/:id', reqValidator.videosGet, middleware.cache(false), getVideos) 59 router.get('/:id', reqValidator.videosGet, miscMiddleware.cache(false), getVideos)
59 router.delete('/:id', reqValidator.videosRemove, middleware.cache(false), removeVideo) 60 router.delete('/:id', reqValidator.videosRemove, miscMiddleware.cache(false), removeVideo)
60 61
61 module.exports = router 62 module.exports = router
62})() 63})()
diff --git a/routes/views.js b/routes/views.js
index 690913a84..ebd97380e 100644
--- a/routes/views.js
+++ b/routes/views.js
@@ -13,7 +13,7 @@
13 } 13 }
14 14
15 var express = require('express') 15 var express = require('express')
16 var middleware = require('../middlewares') 16 var middleware = require('../middlewares').misc
17 17
18 var router = express.Router() 18 var router = express.Router()
19 19