5 files changed, 13 insertions, 8 deletions

diff --git a/server/controllers/object-storage-proxy.ts b/server/controllers/object-storage-proxy.ts
index 32b8d21da..6bff05f14 100644
--- a/server/controllers/object-storage-proxy.ts
+++ b/server/controllers/object-storage-proxy.ts
@@ -77,7 +77,7 @@ async function proxifyHLS (req: express.Request, res: express.Response) {
     setS3Headers(res, s3Response)
 
     const streamReplacer = filename.endsWith('.m3u8') && doReinjectVideoFileToken(req)
-      ? new StreamReplacer(line => injectQueryToPlaylistUrls(line, buildReinjectVideoFileTokenQuery(req)))
+      ? new StreamReplacer(line => injectQueryToPlaylistUrls(line, buildReinjectVideoFileTokenQuery(req, filename.endsWith('master.m3u8'))))
       : new PassThrough()
 
     return pipeline(
diff --git a/server/controllers/shared/m3u8-playlist.ts b/server/controllers/shared/m3u8-playlist.ts
index e2a66efc0..cea5eb5d2 100644
--- a/server/controllers/shared/m3u8-playlist.ts
+++ b/server/controllers/shared/m3u8-playlist.ts
@@ -4,8 +4,12 @@ function doReinjectVideoFileToken (req: express.Request) {
   return req.query.videoFileToken && req.query.reinjectVideoFileToken
 }
 
-function buildReinjectVideoFileTokenQuery (req: express.Request) {
-  return 'videoFileToken=' + req.query.videoFileToken
+function buildReinjectVideoFileTokenQuery (req: express.Request, isMaster: boolean) {
+  const query = 'videoFileToken=' + req.query.videoFileToken
+  if (isMaster) {
+    return query + '&reinjectVideoFileToken=true'
+  }
+  return query
 }
 
 export {
diff --git a/server/controllers/static.ts b/server/controllers/static.ts
index 52e48267f..9baff94c0 100644
--- a/server/controllers/static.ts
+++ b/server/controllers/static.ts
@@ -90,6 +90,7 @@ export {
 
 async function servePrivateM3U8 (req: express.Request, res: express.Response) {
   const path = join(DIRECTORIES.HLS_STREAMING_PLAYLIST.PRIVATE, req.params.videoUUID, req.params.playlistName + '.m3u8')
+  const filename = req.params.playlistName + '.m3u8'
 
   let playlistContent: string
 
@@ -108,7 +109,7 @@ async function servePrivateM3U8 (req: express.Request, res: express.Response) {
 
   // Inject token in playlist so players that cannot alter the HTTP request can still watch the video
   const transformedContent = doReinjectVideoFileToken(req)
-    ? injectQueryToPlaylistUrls(playlistContent, buildReinjectVideoFileTokenQuery(req))
+    ? injectQueryToPlaylistUrls(playlistContent, buildReinjectVideoFileTokenQuery(req, filename.endsWith('master.m3u8')))
     : playlistContent
 
   return res.set('content-type', 'application/vnd.apple.mpegurl').send(transformedContent).end()
diff --git a/server/tests/api/videos/video-static-file-privacy.ts b/server/tests/api/videos/video-static-file-privacy.ts
index ef0774b41..16530884e 100644
--- a/server/tests/api/videos/video-static-file-privacy.ts
+++ b/server/tests/api/videos/video-static-file-privacy.ts
@@ -256,10 +256,9 @@ describe('Test video static file privacy', function () {
       const videoFileToken = await server.videoToken.getVideoFileToken({ videoId: uuid })
       await waitJobs([ server ])
 
-      const video = await server.videos.getWithToken({ id: uuid })
-      const hls = video.streamingPlaylists[0]
-
       {
+        const video = await server.videos.getWithToken({ id: uuid })
+        const hls = video.streamingPlaylists[0]
         const query = { videoFileToken }
         const { text } = await makeRawRequest({ url: hls.playlistUrl, query, expectedStatus: HttpStatusCode.OK_200 })
 
diff --git a/server/tests/shared/streaming-playlists.ts b/server/tests/shared/streaming-playlists.ts
index 75e135c4e..1c38cb512 100644
--- a/server/tests/shared/streaming-playlists.ts
+++ b/server/tests/shared/streaming-playlists.ts
@@ -214,7 +214,7 @@ async function checkVideoFileTokenReinjection (options: {
       ? i
       : `-${resolution}`
 
-    expect(text).to.contain(`${suffix}.m3u8?videoFileToken=${videoFileToken}`)
+    expect(text).to.contain(`${suffix}.m3u8?videoFileToken=${videoFileToken}&reinjectVideoFileToken=true`)
   }
 
   const resolutionPlaylists = extractResolutionPlaylistUrls(hls.playlistUrl, text)
@@ -228,6 +228,7 @@ async function checkVideoFileTokenReinjection (options: {
       : '.mp4'
 
     expect(text).to.contain(`${extension}?videoFileToken=${videoFileToken}`)
+    expect(text).not.to.contain(`reinjectVideoFileToken=true`)
   }
 }