2 files changed, 17 insertions, 6 deletions

diff --git a/server/middlewares/validators/config.ts b/server/middlewares/validators/config.ts
index 16a840667..5f1ac89bc 100644
--- a/server/middlewares/validators/config.ts
+++ b/server/middlewares/validators/config.ts
@@ -1,13 +1,14 @@
 import express from 'express'
 import { body } from 'express-validator'
 import { isIntOrNull } from '@server/helpers/custom-validators/misc'
-import { isEmailEnabled } from '@server/initializers/config'
+import { CONFIG, isEmailEnabled } from '@server/initializers/config'
 import { CustomConfig } from '../../../shared/models/server/custom-config.model'
 import { isThemeNameValid } from '../../helpers/custom-validators/plugins'
 import { isUserNSFWPolicyValid, isUserVideoQuotaDailyValid, isUserVideoQuotaValid } from '../../helpers/custom-validators/users'
 import { logger } from '../../helpers/logger'
 import { isThemeRegistered } from '../../lib/plugins/theme-utils'
 import { areValidationErrors } from './shared'
+import { HttpStatusCode } from '@shared/models/http/http-error-codes'
 
 const customConfigUpdateValidator = [
   body('instance.name').exists().withMessage('Should have a valid instance name'),
@@ -104,10 +105,21 @@ const customConfigUpdateValidator = [
   }
 ]
 
+function ensureConfigIsEditable (req: express.Request, res: express.Response, next: express.NextFunction) {
+  if (!CONFIG.WEBADMIN.CONFIGURATION.EDITS.ALLOWED) {
+    return res.fail({
+      status: HttpStatusCode.METHOD_NOT_ALLOWED_405,
+      message: 'Server configuration is static and cannot be edited'
+    })
+  }
+  return next()
+}
+
 // ---------------------------------------------------------------------------
 
 export {
-  customConfigUpdateValidator
+  customConfigUpdateValidator,
+  ensureConfigIsEditable
 }
 
 function checkInvalidConfigIfEmailDisabled (customConfig: CustomConfig, res: express.Response) {
diff --git a/server/middlewares/validators/oembed.ts b/server/middlewares/validators/oembed.ts
index 96c8adc99..32dd05271 100644
--- a/server/middlewares/validators/oembed.ts
+++ b/server/middlewares/validators/oembed.ts
@@ -28,7 +28,6 @@ function buildUrls (paths: string[]) {
 const startPlaylistURLs = buildUrls(playlistPaths)
 const startVideoURLs = buildUrls(videoPaths)
 
-const watchRegex = /([^/]+)$/
 const isURLOptions = {
   require_host: true,
   require_tld: true
@@ -81,9 +80,9 @@ const oembedValidator = [
 
     const startIsOk = isVideo || isPlaylist
 
-    const matches = watchRegex.exec(urlPath)
+    const parts = urlPath.split('/')
 
-    if (startIsOk === false || matches === null) {
+    if (startIsOk === false || parts.length === 0) {
       return res.fail({
         status: HttpStatusCode.BAD_REQUEST_400,
         message: 'Invalid url.',
@@ -93,7 +92,7 @@ const oembedValidator = [
       })
     }
 
-    const elementId = toCompleteUUID(matches[1])
+    const elementId = toCompleteUUID(parts.pop())
     if (isIdOrUUIDValid(elementId) === false) {
       return res.fail({ message: 'Invalid video or playlist id.' })
     }