aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/middlewares
diff options
context:
space:
mode:
Diffstat (limited to 'server/middlewares')
-rw-r--r--server/middlewares/validators/videos/video-comments.ts23
1 files changed, 22 insertions, 1 deletions
diff --git a/server/middlewares/validators/videos/video-comments.ts b/server/middlewares/validators/videos/video-comments.ts
index 665fb04c8..91ae31ec2 100644
--- a/server/middlewares/validators/videos/video-comments.ts
+++ b/server/middlewares/validators/videos/video-comments.ts
@@ -8,7 +8,14 @@ import { logger } from '../../../helpers/logger'
8import { AcceptResult, isLocalVideoCommentReplyAccepted, isLocalVideoThreadAccepted } from '../../../lib/moderation' 8import { AcceptResult, isLocalVideoCommentReplyAccepted, isLocalVideoThreadAccepted } from '../../../lib/moderation'
9import { Hooks } from '../../../lib/plugins/hooks' 9import { Hooks } from '../../../lib/plugins/hooks'
10import { MCommentOwnerVideoReply, MVideo, MVideoFullLight } from '../../../types/models/video' 10import { MCommentOwnerVideoReply, MVideo, MVideoFullLight } from '../../../types/models/video'
11import { areValidationErrors, doesVideoCommentExist, doesVideoCommentThreadExist, doesVideoExist, isValidVideoIdParam } from '../shared' 11import {
12 areValidationErrors,
13 checkCanSeeVideoIfPrivate,
14 doesVideoCommentExist,
15 doesVideoCommentThreadExist,
16 doesVideoExist,
17 isValidVideoIdParam
18} from '../shared'
12 19
13const listVideoCommentsValidator = [ 20const listVideoCommentsValidator = [
14 query('isLocal') 21 query('isLocal')
@@ -47,6 +54,13 @@ const listVideoCommentThreadsValidator = [
47 if (areValidationErrors(req, res)) return 54 if (areValidationErrors(req, res)) return
48 if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return 55 if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return
49 56
57 if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.onlyVideo)) {
58 return res.fail({
59 status: HttpStatusCode.FORBIDDEN_403,
60 message: 'Cannot list comments of private/internal/blocklisted video'
61 })
62 }
63
50 return next() 64 return next()
51 } 65 }
52] 66]
@@ -64,6 +78,13 @@ const listVideoThreadCommentsValidator = [
64 if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return 78 if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return
65 if (!await doesVideoCommentThreadExist(req.params.threadId, res.locals.onlyVideo, res)) return 79 if (!await doesVideoCommentThreadExist(req.params.threadId, res.locals.onlyVideo, res)) return
66 80
81 if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.onlyVideo)) {
82 return res.fail({
83 status: HttpStatusCode.FORBIDDEN_403,
84 message: 'Cannot list threads of private/internal/blocklisted video'
85 })
86 }
87
67 return next() 88 return next()
68 } 89 }
69] 90]