16 files changed, 252 insertions, 60 deletions

diff --git a/server/middlewares/admin.js b/server/middlewares/admin.js
new file mode 100644
index 000000000..e6d9dc887
--- /dev/null
+++ b/server/middlewares/admin.js
@@ -0,0 +1,22 @@
+'use strict'
+
+const constants = require('../initializers/constants')
+const logger = require('../helpers/logger')
+
+const adminMiddleware = {
+  ensureIsAdmin
+}
+
+function ensureIsAdmin (req, res, next) {
+  const user = res.locals.oauth.token.user
+  if (user.role !== constants.USER_ROLES.ADMIN) {
+    logger.info('A non admin user is trying to access to an admin content.')
+    return res.sendStatus(403)
+  }
+
+  return next()
+}
+
+// ---------------------------------------------------------------------------
+
+module.exports = adminMiddleware
diff --git a/server/middlewares/index.js b/server/middlewares/index.js
index 0a233e701..3f253e31b 100644
--- a/server/middlewares/index.js
+++ b/server/middlewares/index.js
@@ -1,19 +1,23 @@
 'use strict'
 
-const oauth = require('./oauth')
-const pagination = require('./pagination')
+const adminMiddleware = require('./admin')
+const oauthMiddleware = require('./oauth')
+const paginationMiddleware = require('./pagination')
+const podsMiddleware = require('./pods')
 const validatorsMiddleware = require('./validators')
-const search = require('./search')
-const sort = require('./sort')
+const searchMiddleware = require('./search')
+const sortMiddleware = require('./sort')
 const secureMiddleware = require('./secure')
 
 const middlewares = {
-  oauth: oauth,
-  pagination: pagination,
-  validators: validatorsMiddleware,
-  search: search,
-  sort: sort,
-  secure: secureMiddleware
+  admin: adminMiddleware,
+  oauth: oauthMiddleware,
+  pagination: paginationMiddleware,
+  pods: podsMiddleware,
+  search: searchMiddleware,
+  secure: secureMiddleware,
+  sort: sortMiddleware,
+  validators: validatorsMiddleware
 }
 
 // ---------------------------------------------------------------------------
diff --git a/server/middlewares/oauth.js b/server/middlewares/oauth.js
index 91a990509..3a02b9b48 100644
--- a/server/middlewares/oauth.js
+++ b/server/middlewares/oauth.js
@@ -12,8 +12,8 @@ const oAuthServer = new OAuthServer({
 })
 
 const oAuth = {
-  authenticate: authenticate,
-  token: token
+  authenticate,
+  token
 }
 
 function authenticate (req, res, next) {
@@ -23,7 +23,7 @@ function authenticate (req, res, next) {
       return res.sendStatus(500)
     }
 
-    if (res.statusCode === 401 || res.statusCode === 400) return res.end()
+    if (res.statusCode === 401 || res.statusCode === 400 || res.statusCode === 503) return res.end()
 
     return next()
   })
diff --git a/server/middlewares/pagination.js b/server/middlewares/pagination.js
index a571e51f6..a90f60aab 100644
--- a/server/middlewares/pagination.js
+++ b/server/middlewares/pagination.js
@@ -3,7 +3,7 @@
 const constants = require('../initializers/constants')
 
 const paginationMiddleware = {
-  setPagination: setPagination
+  setPagination
 }
 
 function setPagination (req, res, next) {
diff --git a/server/middlewares/pods.js b/server/middlewares/pods.js
new file mode 100644
index 000000000..6e0874a76
--- /dev/null
+++ b/server/middlewares/pods.js
@@ -0,0 +1,62 @@
+'use strict'
+
+const urlModule = require('url')
+
+const logger = require('../helpers/logger')
+
+const podsMiddleware = {
+  setBodyUrlsPort,
+  setBodyUrlPort
+}
+
+function setBodyUrlsPort (req, res, next) {
+  for (let i = 0; i < req.body.urls.length; i++) {
+    const urlWithPort = getUrlWithPort(req.body.urls[i])
+
+    // Problem with the url parsing?
+    if (urlWithPort === null) {
+      return res.sendStatus(500)
+    }
+
+    req.body.urls[i] = urlWithPort
+  }
+
+  return next()
+}
+
+function setBodyUrlPort (req, res, next) {
+  const urlWithPort = getUrlWithPort(req.body.url)
+
+  // Problem with the url parsing?
+  if (urlWithPort === null) {
+    return res.sendStatus(500)
+  }
+
+  req.body.url = urlWithPort
+
+  return next()
+}
+
+// ---------------------------------------------------------------------------
+
+module.exports = podsMiddleware
+
+// ---------------------------------------------------------------------------
+
+function getUrlWithPort (url) {
+  const urlObj = urlModule.parse(url)
+
+  // Add the port if it is not specified
+  if (urlObj.port === null) {
+    if (urlObj.protocol === 'http:') {
+      return url + ':80'
+    } else if (urlObj.protocol === 'https:') {
+      return url + ':443'
+    } else {
+      logger.error('Unknown url protocol: ' + urlObj.protocol)
+      return null
+    }
+  }
+
+  return url
+}
diff --git a/server/middlewares/search.js b/server/middlewares/search.js
index 89302a564..bb88faf54 100644
--- a/server/middlewares/search.js
+++ b/server/middlewares/search.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const searchMiddleware = {
-  setVideosSearch: setVideosSearch
+  setVideosSearch
 }
 
 function setVideosSearch (req, res, next) {
diff --git a/server/middlewares/secure.js b/server/middlewares/secure.js
index 9779c14ac..58f824d14 100644
--- a/server/middlewares/secure.js
+++ b/server/middlewares/secure.js
@@ -7,10 +7,11 @@ const peertubeCrypto = require('../helpers/peertube-crypto')
 const Pod = mongoose.model('Pod')
 
 const secureMiddleware = {
-  decryptBody: decryptBody
+  checkSignature,
+  decryptBody
 }
 
-function decryptBody (req, res, next) {
+function checkSignature (req, res, next) {
   const url = req.body.signature.url
   Pod.loadByUrl(url, function (err, pod) {
     if (err) {
@@ -28,21 +29,30 @@ function decryptBody (req, res, next) {
     const signatureOk = peertubeCrypto.checkSignature(pod.publicKey, url, req.body.signature.signature)
 
     if (signatureOk === true) {
-      peertubeCrypto.decrypt(req.body.key, req.body.data, function (err, decrypted) {
-        if (err) {
-          logger.error('Cannot decrypt data.', { error: err })
-          return res.sendStatus(500)
-        }
-
-        req.body.data = JSON.parse(decrypted)
-        delete req.body.key
-
-        next()
-      })
-    } else {
-      logger.error('Signature is not okay in decryptBody for %s.', req.body.signature.url)
-      return res.sendStatus(403)
+      return next()
+    }
+
+    logger.error('Signature is not okay in decryptBody for %s.', req.body.signature.url)
+    return res.sendStatus(403)
+  })
+}
+
+function decryptBody (req, res, next) {
+  peertubeCrypto.decrypt(req.body.key, req.body.data, function (err, decrypted) {
+    if (err) {
+      logger.error('Cannot decrypt data.', { error: err })
+      return res.sendStatus(500)
     }
+
+    try {
+      req.body.data = JSON.parse(decrypted)
+      delete req.body.key
+    } catch (err) {
+      logger.error('Error in JSON.parse', { error: err })
+      return res.sendStatus(500)
+    }
+
+    next()
   })
 }
 
diff --git a/server/middlewares/sort.js b/server/middlewares/sort.js
index 9f52290a6..f0b7274eb 100644
--- a/server/middlewares/sort.js
+++ b/server/middlewares/sort.js
@@ -1,7 +1,14 @@
 'use strict'
 
 const sortMiddleware = {
-  setVideosSort: setVideosSort
+  setUsersSort,
+  setVideosSort
+}
+
+function setUsersSort (req, res, next) {
+  if (!req.query.sort) req.query.sort = '-createdDate'
+
+  return next()
 }
 
 function setVideosSort (req, res, next) {
diff --git a/server/middlewares/validators/index.js b/server/middlewares/validators/index.js
index 0471b3f92..6c3a9c2b4 100644
--- a/server/middlewares/validators/index.js
+++ b/server/middlewares/validators/index.js
@@ -4,6 +4,7 @@ const paginationValidators = require('./pagination')
 const podsValidators = require('./pods')
 const remoteValidators = require('./remote')
 const sortValidators = require('./sort')
+const usersValidators = require('./users')
 const videosValidators = require('./videos')
 
 const validators = {
@@ -11,6 +12,7 @@ const validators = {
   pods: podsValidators,
   remote: remoteValidators,
   sort: sortValidators,
+  users: usersValidators,
   videos: videosValidators
 }
 
diff --git a/server/middlewares/validators/pagination.js b/server/middlewares/validators/pagination.js
index 8e9a01053..16682696e 100644
--- a/server/middlewares/validators/pagination.js
+++ b/server/middlewares/validators/pagination.js
@@ -4,7 +4,7 @@ const checkErrors = require('./utils').checkErrors
 const logger = require('../../helpers/logger')
 
 const validatorsPagination = {
-  pagination: pagination
+  pagination
 }
 
 function pagination (req, res, next) {
diff --git a/server/middlewares/validators/pods.js b/server/middlewares/validators/pods.js
index fda2e865f..fd3d1e2f2 100644
--- a/server/middlewares/validators/pods.js
+++ b/server/middlewares/validators/pods.js
@@ -5,23 +5,29 @@ const friends = require('../../lib/friends')
 const logger = require('../../helpers/logger')
 
 const validatorsPod = {
-  makeFriends: makeFriends,
-  podsAdd: podsAdd
+  makeFriends,
+  podsAdd
 }
 
 function makeFriends (req, res, next) {
-  friends.hasFriends(function (err, hasFriends) {
-    if (err) {
-      logger.error('Cannot know if we have friends.', { error: err })
-      res.sendStatus(500)
-    }
-
-    if (hasFriends === true) {
-      // We need to quit our friends before make new ones
-      res.sendStatus(409)
-    } else {
-      return next()
-    }
+  req.checkBody('urls', 'Should have an array of unique urls').isEachUniqueUrlValid()
+
+  logger.debug('Checking makeFriends parameters', { parameters: req.body })
+
+  checkErrors(req, res, function () {
+    friends.hasFriends(function (err, hasFriends) {
+      if (err) {
+        logger.error('Cannot know if we have friends.', { error: err })
+        res.sendStatus(500)
+      }
+
+      if (hasFriends === true) {
+        // We need to quit our friends before make new ones
+        res.sendStatus(409)
+      } else {
+        return next()
+      }
+    })
   })
 }
 
diff --git a/server/middlewares/validators/remote.js b/server/middlewares/validators/remote.js
index 1be119458..8c29ef8ca 100644
--- a/server/middlewares/validators/remote.js
+++ b/server/middlewares/validators/remote.js
@@ -4,9 +4,9 @@ const checkErrors = require('./utils').checkErrors
 const logger = require('../../helpers/logger')
 
 const validatorsRemote = {
-  dataToDecrypt: dataToDecrypt,
-  remoteVideos: remoteVideos,
-  signature: signature
+  dataToDecrypt,
+  remoteVideos,
+  signature
 }
 
 function dataToDecrypt (req, res, next) {
@@ -19,7 +19,6 @@ function dataToDecrypt (req, res, next) {
 }
 
 function remoteVideos (req, res, next) {
-  req.checkBody('data').isArray()
   req.checkBody('data').isEachRemoteVideosValid()
 
   logger.debug('Checking remoteVideos parameters', { parameters: req.body })
diff --git a/server/middlewares/validators/sort.js b/server/middlewares/validators/sort.js
index 56b63cc8b..431d3fffd 100644
--- a/server/middlewares/validators/sort.js
+++ b/server/middlewares/validators/sort.js
@@ -5,7 +5,18 @@ const constants = require('../../initializers/constants')
 const logger = require('../../helpers/logger')
 
 const validatorsSort = {
-  videosSort: videosSort
+  usersSort,
+  videosSort
+}
+
+function usersSort (req, res, next) {
+  const sortableColumns = constants.SORTABLE_COLUMNS.USERS
+
+  req.checkQuery('sort', 'Should have correct sortable column').optional().isIn(sortableColumns)
+
+  logger.debug('Checking sort parameters', { parameters: req.query })
+
+  checkErrors(req, res, next)
 }
 
 function videosSort (req, res, next) {
diff --git a/server/middlewares/validators/users.js b/server/middlewares/validators/users.js
new file mode 100644
index 000000000..d541e9124
--- /dev/null
+++ b/server/middlewares/validators/users.js
@@ -0,0 +1,67 @@
+'use strict'
+
+const mongoose = require('mongoose')
+
+const checkErrors = require('./utils').checkErrors
+const logger = require('../../helpers/logger')
+
+const User = mongoose.model('User')
+
+const validatorsUsers = {
+  usersAdd,
+  usersRemove,
+  usersUpdate
+}
+
+function usersAdd (req, res, next) {
+  req.checkBody('username', 'Should have a valid username').isUserUsernameValid()
+  req.checkBody('password', 'Should have a valid password').isUserPasswordValid()
+
+  logger.debug('Checking usersAdd parameters', { parameters: req.body })
+
+  checkErrors(req, res, function () {
+    User.loadByUsername(req.body.username, function (err, user) {
+      if (err) {
+        logger.error('Error in usersAdd request validator.', { error: err })
+        return res.sendStatus(500)
+      }
+
+      if (user) return res.status(409).send('User already exists.')
+
+      next()
+    })
+  })
+}
+
+function usersRemove (req, res, next) {
+  req.checkParams('id', 'Should have a valid id').notEmpty().isMongoId()
+
+  logger.debug('Checking usersRemove parameters', { parameters: req.params })
+
+  checkErrors(req, res, function () {
+    User.loadById(req.params.id, function (err, user) {
+      if (err) {
+        logger.error('Error in usersRemove request validator.', { error: err })
+        return res.sendStatus(500)
+      }
+
+      if (!user) return res.status(404).send('User not found')
+
+      next()
+    })
+  })
+}
+
+function usersUpdate (req, res, next) {
+  req.checkParams('id', 'Should have a valid id').notEmpty().isMongoId()
+  // Add old password verification
+  req.checkBody('password', 'Should have a valid password').isUserPasswordValid()
+
+  logger.debug('Checking usersUpdate parameters', { parameters: req.body })
+
+  checkErrors(req, res, next)
+}
+
+// ---------------------------------------------------------------------------
+
+module.exports = validatorsUsers
diff --git a/server/middlewares/validators/utils.js b/server/middlewares/validators/utils.js
index f6e5b2b38..3741b84c6 100644
--- a/server/middlewares/validators/utils.js
+++ b/server/middlewares/validators/utils.js
@@ -5,7 +5,7 @@ const util = require('util')
 const logger = require('../../helpers/logger')
 
 const validatorsUtils = {
-  checkErrors: checkErrors
+  checkErrors
 }
 
 function checkErrors (req, res, next, statusCode) {
diff --git a/server/middlewares/validators/videos.js b/server/middlewares/validators/videos.js
index 3e2af06fb..76e943e77 100644
--- a/server/middlewares/validators/videos.js
+++ b/server/middlewares/validators/videos.js
@@ -4,20 +4,21 @@ const mongoose = require('mongoose')
 
 const checkErrors = require('./utils').checkErrors
 const constants = require('../../initializers/constants')
-const customValidators = require('../../helpers/custom-validators')
+const customVideosValidators = require('../../helpers/custom-validators').videos
 const logger = require('../../helpers/logger')
 
 const Video = mongoose.model('Video')
 
 const validatorsVideos = {
-  videosAdd: videosAdd,
-  videosGet: videosGet,
-  videosRemove: videosRemove,
-  videosSearch: videosSearch
+  videosAdd,
+  videosGet,
+  videosRemove,
+  videosSearch
 }
 
 function videosAdd (req, res, next) {
   req.checkFiles('videofile[0].originalname', 'Should have an input video').notEmpty()
+  // TODO: move to constants and function
   req.checkFiles('videofile[0].mimetype', 'Should have a correct mime type').matches(/video\/(webm)|(mp4)|(ogg)/i)
   req.checkBody('name', 'Should have a valid name').isVideoNameValid()
   req.checkBody('description', 'Should have a valid description').isVideoDescriptionValid()
@@ -33,8 +34,8 @@ function videosAdd (req, res, next) {
         return res.status(400).send('Cannot retrieve metadata of the file.')
       }
 
-      if (!customValidators.isVideoDurationValid(duration)) {
-        return res.status(400).send('Duration of the video file is too big (max: ' + constants.VIDEOS_CONSTRAINTS_FIELDS.DURATION.max + 's).')
+      if (!customVideosValidators.isVideoDurationValid(duration)) {
+        return res.status(400).send('Duration of the video file is too big (max: ' + constants.CONSTRAINTS_FIELDS.VIDEOS.DURATION.max + 's).')
       }
 
       videoFile.duration = duration
@@ -76,6 +77,7 @@ function videosRemove (req, res, next) {
 
       if (!video) return res.status(404).send('Video not found')
       else if (video.isOwned() === false) return res.status(403).send('Cannot remove video of another pod')
+      else if (video.author !== res.locals.oauth.token.user.username) return res.status(403).send('Cannot remove video of another user')
 
       next()
     })