7 files changed, 19 insertions, 35 deletions

diff --git a/client/package.json b/client/package.json
index b8a737c5c..478558ada 100644
--- a/client/package.json
+++ b/client/package.json
@@ -108,7 +108,7 @@
     "lodash-es": "^4.17.4",
     "markdown-it": "12.3.2",
     "mini-css-extract-plugin": "^2.2.0",
-    "ngx-uploadx": "^4.1.0",
+    "ngx-uploadx": "^5.0.0",
     "path-browserify": "^1.0.0",
     "postcss": "^8.3.11",
     "primeng": "^13.0.0-rc.1",
diff --git a/client/yarn.lock b/client/yarn.lock
index 68abb6e36..c2593c376 100644
--- a/client/yarn.lock
+++ b/client/yarn.lock
@@ -8237,12 +8237,12 @@ next-event@^1.0.0:
   resolved "https://registry.yarnpkg.com/next-event/-/next-event-1.0.0.tgz#e7778acde2e55802e0ad1879c39cf6f75eda61d8"
   integrity sha1-53eKzeLlWALgrRh5w5z2917aYdg=
 
-ngx-uploadx@^4.1.0:
-  version "4.1.5"
-  resolved "https://registry.yarnpkg.com/ngx-uploadx/-/ngx-uploadx-4.1.5.tgz#6ea4e5db203d23185e44f41e71935906cce0d433"
-  integrity sha512-59uyAKMampdOOBWQQknEbALEl8+TvD8bkQ13O7deerP8+CkLtx7z1MyqxGLmgbhBrgsTjBlmnjzAt21vTSWFGA==
+ngx-uploadx@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/ngx-uploadx/-/ngx-uploadx-5.0.0.tgz#f88d13ec281ae3b418179d40cf3c8ab68305f2df"
+  integrity sha512-6+6hndxLmfJNOgYn/NIuZAHVZEFtp2bdZ3L9c+E6ryoNviKdwHf3brmW833/qmYtqP2hioA8EEfbHko/1IIE2Q==
   dependencies:
-    tslib "^1.9.0"
+    tslib "^2.2.0"
 
 nice-napi@^1.0.2:
   version "1.0.2"
@@ -11441,7 +11441,7 @@ tsconfig-paths@^3.12.0:
     minimist "^1.2.0"
     strip-bom "^3.0.0"
 
-tslib@2.3.1, tslib@^2.0.0, tslib@^2.0.1, tslib@^2.0.3, tslib@^2.1.0, tslib@^2.3.0, tslib@^2.3.1:
+tslib@2.3.1, tslib@^2.0.0, tslib@^2.0.1, tslib@^2.0.3, tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.0, tslib@^2.3.1:
   version "2.3.1"
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.3.1.tgz#e8a335add5ceae51aa261d32a490158ef042ef01"
   integrity sha512-77EbyPPpMz+FRFRuAFlWMtmgUWGe9UOG2Z25NqCwiIjRhOf5iKGuzSe5P2w1laq+FkRy4p+PCuVkJSGkzTEKVw==
diff --git a/package.json b/package.json
index 80d60cf15..784b69aba 100644
--- a/package.json
+++ b/package.json
@@ -80,7 +80,7 @@
     "@aws-sdk/client-s3": "^3.23.0",
     "@babel/parser": "7.16.8",
     "@peertube/http-signature": "^1.4.0",
-    "@uploadx/core": "^4.4.0",
+    "@uploadx/core": "^5.0.0",
     "async": "^3.0.1",
     "async-lru": "^1.1.1",
     "bcrypt": "5.0.1",
diff --git a/server/controllers/api/videos/upload.ts b/server/controllers/api/videos/upload.ts
index 89787f20b..fd90d9915 100644
--- a/server/controllers/api/videos/upload.ts
+++ b/server/controllers/api/videos/upload.ts
@@ -40,8 +40,7 @@ import {
   authenticate,
   videosAddLegacyValidator,
   videosAddResumableInitValidator,
-  videosAddResumableValidator,
-  videosResumableUploadIdValidator
+  videosAddResumableValidator
 } from '../../../middlewares'
 import { ScheduleVideoUpdateModel } from '../../../models/video/schedule-video-update'
 import { VideoModel } from '../../../models/video/video'
@@ -88,7 +87,6 @@ uploadRouter.post('/upload-resumable',
 
 uploadRouter.delete('/upload-resumable',
   authenticate,
-  videosResumableUploadIdValidator,
   asyncMiddleware(deleteUploadResumableCache),
   uploadx.upload
 )
@@ -96,7 +94,6 @@ uploadRouter.delete('/upload-resumable',
 uploadRouter.put('/upload-resumable',
   openapiOperationDoc({ operationId: 'uploadResumable' }),
   authenticate,
-  videosResumableUploadIdValidator,
   uploadx.upload, // uploadx doesn't next() before the file upload completes
   asyncMiddleware(videosAddResumableValidator),
   asyncMiddleware(addVideoResumable)
diff --git a/server/lib/uploadx.ts b/server/lib/uploadx.ts
index 36f5a556c..34a4461f0 100644
--- a/server/lib/uploadx.ts
+++ b/server/lib/uploadx.ts
@@ -5,9 +5,13 @@ import { Uploadx } from '@uploadx/core'
 const uploadx = new Uploadx({
   directory: getResumableUploadPath(),
   // Could be big with thumbnails/previews
-  maxMetadataSize: '10MB'
+  maxMetadataSize: '10MB',
+  userIdentifier: (_, res: express.Response) => {
+    if (!res.locals.oauth) return undefined
+
+    return res.locals.oauth.token.user.id + ''
+  }
 })
-uploadx.getUserId = (_, res: express.Response) => res.locals.oauth?.token.user.id
 
 export {
   uploadx
diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts
index 3a1a905f3..b3ffb7007 100644
--- a/server/middlewares/validators/videos/videos.ts
+++ b/server/middlewares/validators/videos/videos.ts
@@ -102,22 +102,6 @@ const videosAddLegacyValidator = getCommonVideoEditAttributes().concat([
   }
 ])
 
-const videosResumableUploadIdValidator = [
-  (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    const user = res.locals.oauth.token.User
-    const uploadId = req.query.upload_id
-
-    if (uploadId.startsWith(user.id + '-') !== true) {
-      return res.fail({
-        status: HttpStatusCode.FORBIDDEN_403,
-        message: 'You cannot send chunks in another user upload'
-      })
-    }
-
-    return next()
-  }
-]
-
 /**
  * Gets called after the last PUT request
  */
@@ -566,7 +550,6 @@ export {
   videosAddLegacyValidator,
   videosAddResumableValidator,
   videosAddResumableInitValidator,
-  videosResumableUploadIdValidator,
 
   videosUpdateValidator,
   videosGetValidator,
diff --git a/yarn.lock b/yarn.lock
index fa1789237..42428c1ee 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2040,10 +2040,10 @@
   resolved "https://registry.yarnpkg.com/@ungap/promise-all-settled/-/promise-all-settled-1.1.2.tgz#aa58042711d6e3275dd37dc597e5d31e8c290a44"
   integrity sha512-sL/cEvJWAnClXw0wHk85/2L0G6Sj8UB0Ctc1TEMbKSsmpRosqhwj9gWgFRZSrBr2f9tiXISwNhCPmlfqUqyb9Q==
 
-"@uploadx/core@^4.4.0":
-  version "4.5.0"
-  resolved "https://registry.yarnpkg.com/@uploadx/core/-/core-4.5.0.tgz#4575858a692c482becb579f283158eca8db4a32a"
-  integrity sha512-PQjEqU1zC4h9yjLt25dj9t+pixxaSiO0RG4hP4FS5P2tFA1oXGaDt23H4q1JJRHavgOTff6PJVR5aH1Bhc9wpQ==
+"@uploadx/core@^5.0.0":
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/@uploadx/core/-/core-5.0.0.tgz#6d71683f67064a9223b9c1d0707991b618145375"
+  integrity sha512-7tHQt2TLzU1CfhOk3Nw5A+D+0nqrRuJPzJcCVrpbdvjwwmUvs5Wf623rwEqtLOBznDMevHxO/kXFw/jYXt3Vmg==
   dependencies:
     bytes "^3.1.0"
     debug "^4.3.1"