aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/helpers/middlewares/videos.ts
diff options
context:
space:
mode:
Diffstat (limited to 'server/helpers/middlewares/videos.ts')
-rw-r--r--server/helpers/middlewares/videos.ts23
1 files changed, 11 insertions, 12 deletions
diff --git a/server/helpers/middlewares/videos.ts b/server/helpers/middlewares/videos.ts
index c5eb0607a..403cae092 100644
--- a/server/helpers/middlewares/videos.ts
+++ b/server/helpers/middlewares/videos.ts
@@ -66,25 +66,24 @@ async function doesVideoFileOfVideoExist (id: number, videoIdOrUUID: number | st
66} 66}
67 67
68async function doesVideoChannelOfAccountExist (channelId: number, user: MUserAccountId, res: Response) { 68async function doesVideoChannelOfAccountExist (channelId: number, user: MUserAccountId, res: Response) {
69 if (user.hasRight(UserRight.UPDATE_ANY_VIDEO) === true) { 69 const videoChannel = await VideoChannelModel.loadAndPopulateAccount(channelId)
70 const videoChannel = await VideoChannelModel.loadAndPopulateAccount(channelId)
71 if (videoChannel === null) {
72 res.status(HttpStatusCode.BAD_REQUEST_400)
73 .json({ error: 'Unknown video `video channel` on this instance.' })
74 .end()
75 70
76 return false 71 if (videoChannel === null) {
77 } 72 res.status(HttpStatusCode.BAD_REQUEST_400)
73 .json({ error: 'Unknown video "video channel" for this instance.' })
78 74
75 return false
76 }
77
78 // Don't check account id if the user can update any video
79 if (user.hasRight(UserRight.UPDATE_ANY_VIDEO) === true) {
79 res.locals.videoChannel = videoChannel 80 res.locals.videoChannel = videoChannel
80 return true 81 return true
81 } 82 }
82 83
83 const videoChannel = await VideoChannelModel.loadByIdAndAccount(channelId, user.Account.id) 84 if (videoChannel.Account.id !== user.Account.id) {
84 if (videoChannel === null) {
85 res.status(HttpStatusCode.BAD_REQUEST_400) 85 res.status(HttpStatusCode.BAD_REQUEST_400)
86 .json({ error: 'Unknown video `video channel` for this account.' }) 86 .json({ error: 'Unknown video "video channel" for this account.' })
87 .end()
88 87
89 return false 88 return false
90 } 89 }