3 files changed, 20 insertions, 7 deletions

diff --git a/server/middlewares/validators/redundancy.ts b/server/middlewares/validators/redundancy.ts
index e65d3b8d3..8098e3a44 100644
--- a/server/middlewares/validators/redundancy.ts
+++ b/server/middlewares/validators/redundancy.ts
@@ -25,8 +25,12 @@ const videoFileRedundancyGetValidator = [
     if (!await doesVideoExist(req.params.videoId, res)) return
 
     const video = res.locals.videoAll
+
+    const paramResolution = req.params.resolution as unknown as number // We casted to int above
+    const paramFPS = req.params.fps as unknown as number // We casted to int above
+
     const videoFile = video.VideoFiles.find(f => {
-      return f.resolution === req.params.resolution && (!req.params.fps || f.fps === req.params.fps)
+      return f.resolution === paramResolution && (!req.params.fps || paramFPS)
     })
 
     if (!videoFile) return res.status(404).json({ error: 'Video file not found.' })
@@ -41,8 +45,12 @@ const videoFileRedundancyGetValidator = [
 ]
 
 const videoPlaylistRedundancyGetValidator = [
-  param('videoId').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid video id'),
-  param('streamingPlaylistType').custom(exists).withMessage('Should have a valid streaming playlist type'),
+  param('videoId')
+    .custom(isIdOrUUIDValid)
+    .not().isEmpty().withMessage('Should have a valid video id'),
+  param('streamingPlaylistType')
+    .customSanitizer(toIntOrNull)
+    .custom(exists).withMessage('Should have a valid streaming playlist type'),
 
   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking videoPlaylistRedundancyGetValidator parameters', { parameters: req.params })
@@ -51,7 +59,9 @@ const videoPlaylistRedundancyGetValidator = [
     if (!await doesVideoExist(req.params.videoId, res)) return
 
     const video = res.locals.videoAll
-    const videoStreamingPlaylist = video.VideoStreamingPlaylists.find(p => p === req.params.streamingPlaylistType)
+
+    const paramPlaylistType = req.params.streamingPlaylistType as unknown as number // We casted to int above
+    const videoStreamingPlaylist = video.VideoStreamingPlaylists.find(p => p.type === paramPlaylistType)
 
     if (!videoStreamingPlaylist) return res.status(404).json({ error: 'Video playlist not found.' })
     res.locals.videoStreamingPlaylist = videoStreamingPlaylist
diff --git a/server/middlewares/validators/users.ts b/server/middlewares/validators/users.ts
index b3466333c..804d1410e 100644
--- a/server/middlewares/validators/users.ts
+++ b/server/middlewares/validators/users.ts
@@ -448,7 +448,8 @@ export {
 
 // ---------------------------------------------------------------------------
 
-function checkUserIdExist (id: number, res: express.Response) {
+function checkUserIdExist (idArg: number | string, res: express.Response) {
+  const id = parseInt(idArg + '', 10)
   return checkUserExist(() => UserModel.loadById(id), res)
 }
 
diff --git a/server/middlewares/validators/videos/video-comments.ts b/server/middlewares/validators/videos/video-comments.ts
index 8adbb02ba..1d81eb5d8 100644
--- a/server/middlewares/validators/videos/video-comments.ts
+++ b/server/middlewares/validators/videos/video-comments.ts
@@ -120,7 +120,8 @@ export {
 
 // ---------------------------------------------------------------------------
 
-async function doesVideoCommentThreadExist (id: number, video: MVideoId, res: express.Response) {
+async function doesVideoCommentThreadExist (idArg: number | string, video: MVideoId, res: express.Response) {
+  const id = parseInt(idArg + '', 10)
   const videoComment = await VideoCommentModel.loadById(id)
 
   if (!videoComment) {
@@ -151,7 +152,8 @@ async function doesVideoCommentThreadExist (id: number, video: MVideoId, res: ex
   return true
 }
 
-async function doesVideoCommentExist (id: number, video: MVideoId, res: express.Response) {
+async function doesVideoCommentExist (idArg: number | string, video: MVideoId, res: express.Response) {
+  const id = parseInt(idArg + '', 10)
   const videoComment = await VideoCommentModel.loadByIdAndPopulateVideoAndAccountAndReply(id)
 
   if (!videoComment) {