9 files changed, 189 insertions, 92 deletions

diff --git a/server/helpers/custom-validators/index.js b/server/helpers/custom-validators/index.js
new file mode 100644
index 000000000..96b5b20b9
--- /dev/null
+++ b/server/helpers/custom-validators/index.js
@@ -0,0 +1,17 @@
+'use strict'
+
+const miscValidators = require('./misc')
+const podsValidators = require('./pods')
+const usersValidators = require('./users')
+const videosValidators = require('./videos')
+
+const validators = {
+  misc: miscValidators,
+  pods: podsValidators,
+  users: usersValidators,
+  videos: videosValidators
+}
+
+// ---------------------------------------------------------------------------
+
+module.exports = validators
diff --git a/server/helpers/custom-validators/misc.js b/server/helpers/custom-validators/misc.js
new file mode 100644
index 000000000..052726241
--- /dev/null
+++ b/server/helpers/custom-validators/misc.js
@@ -0,0 +1,18 @@
+'use strict'
+
+const miscValidators = {
+  exists,
+  isArray
+}
+
+function exists (value) {
+  return value !== undefined && value !== null
+}
+
+function isArray (value) {
+  return Array.isArray(value)
+}
+
+// ---------------------------------------------------------------------------
+
+module.exports = miscValidators
diff --git a/server/helpers/custom-validators/pods.js b/server/helpers/custom-validators/pods.js
new file mode 100644
index 000000000..40f8b5d0b
--- /dev/null
+++ b/server/helpers/custom-validators/pods.js
@@ -0,0 +1,21 @@
+'use strict'
+
+const validator = require('express-validator').validator
+
+const miscValidators = require('./misc')
+
+const podsValidators = {
+  isEachUniqueUrlValid
+}
+
+function isEachUniqueUrlValid (urls) {
+  return miscValidators.isArray(urls) &&
+    urls.length !== 0 &&
+    urls.every(function (url) {
+      return validator.isURL(url) && urls.indexOf(url) === urls.lastIndexOf(url)
+    })
+}
+
+// ---------------------------------------------------------------------------
+
+module.exports = podsValidators
diff --git a/server/helpers/custom-validators/users.js b/server/helpers/custom-validators/users.js
new file mode 100644
index 000000000..88fa1592e
--- /dev/null
+++ b/server/helpers/custom-validators/users.js
@@ -0,0 +1,31 @@
+'use strict'
+
+const validator = require('express-validator').validator
+const values = require('lodash/values')
+
+const constants = require('../../initializers/constants')
+const USERS_CONSTRAINTS_FIELDS = constants.CONSTRAINTS_FIELDS.USERS
+
+const usersValidators = {
+  isUserPasswordValid,
+  isUserRoleValid,
+  isUserUsernameValid
+}
+
+function isUserPasswordValid (value) {
+  return validator.isLength(value, USERS_CONSTRAINTS_FIELDS.PASSWORD)
+}
+
+function isUserRoleValid (value) {
+  return values(constants.USER_ROLES).indexOf(value) !== -1
+}
+
+function isUserUsernameValid (value) {
+  const max = USERS_CONSTRAINTS_FIELDS.USERNAME.max
+  const min = USERS_CONSTRAINTS_FIELDS.USERNAME.min
+  return validator.matches(value, new RegExp(`^[a-zA-Z0-9._]{${min},${max}}$`))
+}
+
+// ---------------------------------------------------------------------------
+
+module.exports = usersValidators
diff --git a/server/helpers/custom-validators.js b/server/helpers/custom-validators/videos.js
index b666644c0..a507ff686 100644
--- a/server/helpers/custom-validators.js
+++ b/server/helpers/custom-validators/videos.js
@@ -2,66 +2,51 @@
 
 const validator = require('express-validator').validator
 
-const constants = require('../initializers/constants')
-const VIDEOS_CONSTRAINTS_FIELDS = constants.VIDEOS_CONSTRAINTS_FIELDS
-
-const customValidators = {
-  exists: exists,
-  isEachRemoteVideosValid: isEachRemoteVideosValid,
-  isArray: isArray,
-  isVideoAuthorValid: isVideoAuthorValid,
-  isVideoDateValid: isVideoDateValid,
-  isVideoDescriptionValid: isVideoDescriptionValid,
-  isVideoDurationValid: isVideoDurationValid,
-  isVideoMagnetUriValid: isVideoMagnetUriValid,
-  isVideoNameValid: isVideoNameValid,
-  isVideoPodUrlValid: isVideoPodUrlValid,
-  isVideoTagsValid: isVideoTagsValid,
-  isVideoThumbnailValid: isVideoThumbnailValid,
-  isVideoThumbnail64Valid: isVideoThumbnail64Valid
-}
-
-function exists (value) {
-  return value !== undefined && value !== null
+const constants = require('../../initializers/constants')
+const usersValidators = require('./users')
+const miscValidators = require('./misc')
+const VIDEOS_CONSTRAINTS_FIELDS = constants.CONSTRAINTS_FIELDS.VIDEOS
+
+const videosValidators = {
+  isEachRemoteVideosValid,
+  isVideoAuthorValid,
+  isVideoDateValid,
+  isVideoDescriptionValid,
+  isVideoDurationValid,
+  isVideoMagnetUriValid,
+  isVideoNameValid,
+  isVideoPodUrlValid,
+  isVideoTagsValid,
+  isVideoThumbnailValid,
+  isVideoThumbnail64Valid
 }
 
 function isEachRemoteVideosValid (requests) {
-  return requests.every(function (request) {
-    const video = request.data
-    return (
-      isRequestTypeAddValid(request.type) &&
-      isVideoAuthorValid(video.author) &&
-      isVideoDateValid(video.createdDate) &&
-      isVideoDescriptionValid(video.description) &&
-      isVideoDurationValid(video.duration) &&
-      isVideoMagnetUriValid(video.magnetUri) &&
-      isVideoNameValid(video.name) &&
-      isVideoPodUrlValid(video.podUrl) &&
-      isVideoTagsValid(video.tags) &&
-      isVideoThumbnail64Valid(video.thumbnailBase64)
-    ) ||
-    (
-      isRequestTypeRemoveValid(request.type) &&
-      isVideoNameValid(video.name) &&
-      isVideoMagnetUriValid(video.magnetUri)
-    )
-  })
-}
-
-function isArray (value) {
-  return Array.isArray(value)
-}
-
-function isRequestTypeAddValid (value) {
-  return value === 'add'
-}
-
-function isRequestTypeRemoveValid (value) {
-  return value === 'remove'
+  return miscValidators.isArray(requests) &&
+    requests.every(function (request) {
+      const video = request.data
+      return (
+        isRequestTypeAddValid(request.type) &&
+        isVideoAuthorValid(video.author) &&
+        isVideoDateValid(video.createdDate) &&
+        isVideoDescriptionValid(video.description) &&
+        isVideoDurationValid(video.duration) &&
+        isVideoMagnetUriValid(video.magnetUri) &&
+        isVideoNameValid(video.name) &&
+        isVideoPodUrlValid(video.podUrl) &&
+        isVideoTagsValid(video.tags) &&
+        isVideoThumbnail64Valid(video.thumbnailBase64)
+      ) ||
+      (
+        isRequestTypeRemoveValid(request.type) &&
+        isVideoNameValid(video.name) &&
+        isVideoMagnetUriValid(video.magnetUri)
+      )
+    })
 }
 
 function isVideoAuthorValid (value) {
-  return validator.isLength(value, VIDEOS_CONSTRAINTS_FIELDS.AUTHOR)
+  return usersValidators.isUserUsernameValid(value)
 }
 
 function isVideoDateValid (value) {
@@ -90,7 +75,7 @@ function isVideoPodUrlValid (value) {
 }
 
 function isVideoTagsValid (tags) {
-  return isArray(tags) &&
+  return miscValidators.isArray(tags) &&
          validator.isInt(tags.length, VIDEOS_CONSTRAINTS_FIELDS.TAGS) &&
          tags.every(function (tag) {
            return validator.isAlphanumeric(tag) &&
@@ -109,6 +94,14 @@ function isVideoThumbnail64Valid (value) {
 
 // ---------------------------------------------------------------------------
 
-module.exports = customValidators
+module.exports = videosValidators
 
 // ---------------------------------------------------------------------------
+
+function isRequestTypeAddValid (value) {
+  return value === 'add'
+}
+
+function isRequestTypeRemoveValid (value) {
+  return value === 'remove'
+}
diff --git a/server/helpers/logger.js b/server/helpers/logger.js
index 8ae90a4b2..590ceaeb6 100644
--- a/server/helpers/logger.js
+++ b/server/helpers/logger.js
@@ -1,23 +1,23 @@
 // Thanks http://tostring.it/2014/06/23/advanced-logging-with-nodejs/
 'use strict'
 
-const config = require('config')
 const mkdirp = require('mkdirp')
 const path = require('path')
 const winston = require('winston')
 winston.emitErrs = true
 
-const logDir = path.join(__dirname, '..', '..', config.get('storage.logs'))
-const label = config.get('webserver.host') + ':' + config.get('webserver.port')
+const constants = require('../initializers/constants')
+
+const label = constants.CONFIG.WEBSERVER.HOST + ':' + constants.CONFIG.WEBSERVER.PORT
 
 // Create the directory if it does not exist
-mkdirp.sync(logDir)
+mkdirp.sync(constants.CONFIG.STORAGE.LOG_DIR)
 
 const logger = new winston.Logger({
   transports: [
     new winston.transports.File({
       level: 'debug',
-      filename: path.join(logDir, 'all-logs.log'),
+      filename: path.join(constants.CONFIG.STORAGE.LOG_DIR, 'all-logs.log'),
       handleExceptions: true,
       json: true,
       maxsize: 5242880,
diff --git a/server/helpers/peertube-crypto.js b/server/helpers/peertube-crypto.js
index 46dff8d03..1ff638b04 100644
--- a/server/helpers/peertube-crypto.js
+++ b/server/helpers/peertube-crypto.js
@@ -1,24 +1,24 @@
 'use strict'
 
-const config = require('config')
+const bcrypt = require('bcrypt')
 const crypto = require('crypto')
 const fs = require('fs')
 const openssl = require('openssl-wrapper')
-const path = require('path')
 const ursa = require('ursa')
 
+const constants = require('../initializers/constants')
 const logger = require('./logger')
 
-const certDir = path.join(__dirname, '..', '..', config.get('storage.certs'))
 const algorithm = 'aes-256-ctr'
 
 const peertubeCrypto = {
-  checkSignature: checkSignature,
-  createCertsIfNotExist: createCertsIfNotExist,
-  decrypt: decrypt,
-  encrypt: encrypt,
-  getCertDir: getCertDir,
-  sign: sign
+  checkSignature,
+  comparePassword,
+  createCertsIfNotExist,
+  cryptPassword,
+  decrypt,
+  encrypt,
+  sign
 }
 
 function checkSignature (publicKey, rawData, hexSignature) {
@@ -27,6 +27,14 @@ function checkSignature (publicKey, rawData, hexSignature) {
   return isValid
 }
 
+function comparePassword (plainPassword, hashPassword, callback) {
+  bcrypt.compare(plainPassword, hashPassword, function (err, isPasswordMatch) {
+    if (err) return callback(err)
+
+    return callback(null, isPasswordMatch)
+  })
+}
+
 function createCertsIfNotExist (callback) {
   certsExist(function (exist) {
     if (exist === true) {
@@ -39,8 +47,18 @@ function createCertsIfNotExist (callback) {
   })
 }
 
+function cryptPassword (password, callback) {
+  bcrypt.genSalt(constants.BCRYPT_SALT_SIZE, function (err, salt) {
+    if (err) return callback(err)
+
+    bcrypt.hash(password, salt, function (err, hash) {
+      return callback(err, hash)
+    })
+  })
+}
+
 function decrypt (key, data, callback) {
-  fs.readFile(getCertDir() + 'peertube.key.pem', function (err, file) {
+  fs.readFile(constants.CONFIG.STORAGE.CERT_DIR + 'peertube.key.pem', function (err, file) {
     if (err) return callback(err)
 
     const myPrivateKey = ursa.createPrivateKey(file)
@@ -67,12 +85,8 @@ function encrypt (publicKey, data, callback) {
   })
 }
 
-function getCertDir () {
-  return certDir
-}
-
 function sign (data) {
-  const myKey = ursa.createPrivateKey(fs.readFileSync(certDir + 'peertube.key.pem'))
+  const myKey = ursa.createPrivateKey(fs.readFileSync(constants.CONFIG.STORAGE.CERT_DIR + 'peertube.key.pem'))
   const signature = myKey.hashAndSign('sha256', data, 'utf8', 'hex')
 
   return signature
@@ -85,7 +99,7 @@ module.exports = peertubeCrypto
 // ---------------------------------------------------------------------------
 
 function certsExist (callback) {
-  fs.exists(certDir + 'peertube.key.pem', function (exists) {
+  fs.exists(constants.CONFIG.STORAGE.CERT_DIR + 'peertube.key.pem', function (exists) {
     return callback(exists)
   })
 }
@@ -99,15 +113,25 @@ function createCerts (callback) {
     }
 
     logger.info('Generating a RSA key...')
-    openssl.exec('genrsa', { 'out': certDir + 'peertube.key.pem', '2048': false }, function (err) {
+
+    let options = {
+      'out': constants.CONFIG.STORAGE.CERT_DIR + 'peertube.key.pem',
+      '2048': false
+    }
+    openssl.exec('genrsa', options, function (err) {
       if (err) {
         logger.error('Cannot create private key on this pod.')
         return callback(err)
       }
       logger.info('RSA key generated.')
 
+      options = {
+        'in': constants.CONFIG.STORAGE.CERT_DIR + 'peertube.key.pem',
+        'pubout': true,
+        'out': constants.CONFIG.STORAGE.CERT_DIR + 'peertube.pub'
+      }
       logger.info('Manage public key...')
-      openssl.exec('rsa', { 'in': certDir + 'peertube.key.pem', 'pubout': true, 'out': certDir + 'peertube.pub' }, function (err) {
+      openssl.exec('rsa', options, function (err) {
         if (err) {
           logger.error('Cannot create public key on this pod.')
           return callback(err)
diff --git a/server/helpers/requests.js b/server/helpers/requests.js
index 547230adc..95775c981 100644
--- a/server/helpers/requests.js
+++ b/server/helpers/requests.js
@@ -1,19 +1,14 @@
 'use strict'
 
-const config = require('config')
 const replay = require('request-replay')
 const request = require('request')
 
 const constants = require('../initializers/constants')
 const peertubeCrypto = require('./peertube-crypto')
 
-const http = config.get('webserver.https') ? 'https' : 'http'
-const host = config.get('webserver.host')
-const port = config.get('webserver.port')
-
 const requests = {
-  makeRetryRequest: makeRetryRequest,
-  makeSecureRequest: makeSecureRequest
+  makeRetryRequest,
+  makeSecureRequest
 }
 
 function makeRetryRequest (params, callback) {
@@ -29,8 +24,6 @@ function makeRetryRequest (params, callback) {
 }
 
 function makeSecureRequest (params, callback) {
-  const myUrl = http + '://' + host + ':' + port
-
   const requestParams = {
     url: params.toPod.url + params.path
   }
@@ -42,8 +35,8 @@ function makeSecureRequest (params, callback) {
     // Add signature if it is specified in the params
     if (params.sign === true) {
       requestParams.json.signature = {
-        url: myUrl,
-        signature: peertubeCrypto.sign(myUrl)
+        url: constants.CONFIG.WEBSERVER.URL,
+        signature: peertubeCrypto.sign(constants.CONFIG.WEBSERVER.URL)
       }
     }
 
diff --git a/server/helpers/utils.js b/server/helpers/utils.js
index a77116e08..9c2d402e3 100644
--- a/server/helpers/utils.js
+++ b/server/helpers/utils.js
@@ -5,8 +5,8 @@ const crypto = require('crypto')
 const logger = require('./logger')
 
 const utils = {
-  cleanForExit: cleanForExit,
-  generateRandomString: generateRandomString
+  cleanForExit,
+  generateRandomString
 }
 
 function generateRandomString (size, callback) {