1 files changed, 34 insertions, 1 deletions

diff --git a/server/middlewares/validators/runners/job-files.ts b/server/middlewares/validators/runners/job-files.ts
index 56afa39aa..e5afff0e5 100644
--- a/server/middlewares/validators/runners/job-files.ts
+++ b/server/middlewares/validators/runners/job-files.ts
@@ -1,5 +1,8 @@
 import express from 'express'
-import { HttpStatusCode } from '@shared/models'
+import { param } from 'express-validator'
+import { basename } from 'path'
+import { isSafeFilename } from '@server/helpers/custom-validators/misc'
+import { hasVideoStudioTaskFile, HttpStatusCode, RunnerJobVideoEditionTranscodingPayload } from '@shared/models'
 import { areValidationErrors, doesVideoExist, isValidVideoIdParam } from '../shared'
 
 const tags = [ 'runner' ]
@@ -25,3 +28,33 @@ export const runnerJobGetVideoTranscodingFileValidator = [
     return next()
   }
 ]
+
+export const runnerJobGetVideoStudioTaskFileValidator = [
+  param('filename').custom(v => isSafeFilename(v)),
+
+  (req: express.Request, res: express.Response, next: express.NextFunction) => {
+    if (areValidationErrors(req, res)) return
+
+    const filename = req.params.filename
+
+    const payload = res.locals.runnerJob.payload as RunnerJobVideoEditionTranscodingPayload
+
+    const found = Array.isArray(payload?.tasks) && payload.tasks.some(t => {
+      if (hasVideoStudioTaskFile(t)) {
+        return basename(t.options.file) === filename
+      }
+
+      return false
+    })
+
+    if (!found) {
+      return res.fail({
+        status: HttpStatusCode.BAD_REQUEST_400,
+        message: 'File is not associated to this edition task',
+        tags: [ ...tags, res.locals.videoAll.uuid ]
+      })
+    }
+
+    return next()
+  }
+]