aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/middlewares
diff options
context:
space:
mode:
Diffstat (limited to 'server/middlewares')
-rw-r--r--server/middlewares/validators/sort.ts5
-rw-r--r--server/middlewares/validators/users.ts22
-rw-r--r--server/middlewares/validators/videos/video-channels.ts16
3 files changed, 23 insertions, 20 deletions
diff --git a/server/middlewares/validators/sort.ts b/server/middlewares/validators/sort.ts
index ce8df8fee..3ba668460 100644
--- a/server/middlewares/validators/sort.ts
+++ b/server/middlewares/validators/sort.ts
@@ -53,6 +53,9 @@ const pluginsSortValidator = checkSortFactory(SORTABLE_COLUMNS.PLUGINS)
53const availablePluginsSortValidator = checkSortFactory(SORTABLE_COLUMNS.AVAILABLE_PLUGINS) 53const availablePluginsSortValidator = checkSortFactory(SORTABLE_COLUMNS.AVAILABLE_PLUGINS)
54const videoRedundanciesSortValidator = checkSortFactory(SORTABLE_COLUMNS.VIDEO_REDUNDANCIES) 54const videoRedundanciesSortValidator = checkSortFactory(SORTABLE_COLUMNS.VIDEO_REDUNDANCIES)
55 55
56const accountsFollowersSortValidator = checkSortFactory(SORTABLE_COLUMNS.ACCOUNT_FOLLOWERS)
57const videoChannelsFollowersSortValidator = checkSortFactory(SORTABLE_COLUMNS.CHANNEL_FOLLOWERS)
58
56// --------------------------------------------------------------------------- 59// ---------------------------------------------------------------------------
57 60
58export { 61export {
@@ -79,5 +82,7 @@ export {
79 videoPlaylistsSortValidator, 82 videoPlaylistsSortValidator,
80 videoRedundanciesSortValidator, 83 videoRedundanciesSortValidator,
81 videoPlaylistsSearchSortValidator, 84 videoPlaylistsSearchSortValidator,
85 accountsFollowersSortValidator,
86 videoChannelsFollowersSortValidator,
82 pluginsSortValidator 87 pluginsSortValidator
83} 88}
diff --git a/server/middlewares/validators/users.ts b/server/middlewares/validators/users.ts
index c06b85862..c6eeeaf18 100644
--- a/server/middlewares/validators/users.ts
+++ b/server/middlewares/validators/users.ts
@@ -3,9 +3,7 @@ import { body, param, query } from 'express-validator'
3import { omit } from 'lodash' 3import { omit } from 'lodash'
4import { Hooks } from '@server/lib/plugins/hooks' 4import { Hooks } from '@server/lib/plugins/hooks'
5import { MUserDefault } from '@server/types/models' 5import { MUserDefault } from '@server/types/models'
6import { HttpStatusCode } from '../../../shared/models/http/http-error-codes' 6import { HttpStatusCode, UserRegister, UserRole } from '@shared/models'
7import { UserRole } from '../../../shared/models/users'
8import { UserRegister } from '../../../shared/models/users/user-register.model'
9import { toBooleanOrNull, toIntOrNull } from '../../helpers/custom-validators/misc' 7import { toBooleanOrNull, toIntOrNull } from '../../helpers/custom-validators/misc'
10import { isThemeNameValid } from '../../helpers/custom-validators/plugins' 8import { isThemeNameValid } from '../../helpers/custom-validators/plugins'
11import { 9import {
@@ -462,7 +460,22 @@ const ensureAuthUserOwnsAccountValidator = [
462 if (res.locals.account.id !== user.Account.id) { 460 if (res.locals.account.id !== user.Account.id) {
463 return res.fail({ 461 return res.fail({
464 status: HttpStatusCode.FORBIDDEN_403, 462 status: HttpStatusCode.FORBIDDEN_403,
465 message: 'Only owner can access ratings list.' 463 message: 'Only owner of this account can access this ressource.'
464 })
465 }
466
467 return next()
468 }
469]
470
471const ensureAuthUserOwnsChannelValidator = [
472 (req: express.Request, res: express.Response, next: express.NextFunction) => {
473 const user = res.locals.oauth.token.User
474
475 if (res.locals.videoChannel.Account.userId !== user.id) {
476 return res.fail({
477 status: HttpStatusCode.FORBIDDEN_403,
478 message: 'Only owner of this video channel can access this ressource'
466 }) 479 })
467 } 480 }
468 481
@@ -506,6 +519,7 @@ export {
506 usersVerifyEmailValidator, 519 usersVerifyEmailValidator,
507 userAutocompleteValidator, 520 userAutocompleteValidator,
508 ensureAuthUserOwnsAccountValidator, 521 ensureAuthUserOwnsAccountValidator,
522 ensureAuthUserOwnsChannelValidator,
509 ensureCanManageUser 523 ensureCanManageUser
510} 524}
511 525
diff --git a/server/middlewares/validators/videos/video-channels.ts b/server/middlewares/validators/videos/video-channels.ts
index fc717abf6..ec107fa51 100644
--- a/server/middlewares/validators/videos/video-channels.ts
+++ b/server/middlewares/validators/videos/video-channels.ts
@@ -65,22 +65,6 @@ const videoChannelsUpdateValidator = [
65 logger.debug('Checking videoChannelsUpdate parameters', { parameters: req.body }) 65 logger.debug('Checking videoChannelsUpdate parameters', { parameters: req.body })
66 66
67 if (areValidationErrors(req, res)) return 67 if (areValidationErrors(req, res)) return
68 if (!await doesVideoChannelNameWithHostExist(req.params.nameWithHost, res)) return
69
70 // We need to make additional checks
71 if (res.locals.videoChannel.Actor.isOwned() === false) {
72 return res.fail({
73 status: HttpStatusCode.FORBIDDEN_403,
74 message: 'Cannot update video channel of another server'
75 })
76 }
77
78 if (res.locals.videoChannel.Account.userId !== res.locals.oauth.token.User.id) {
79 return res.fail({
80 status: HttpStatusCode.FORBIDDEN_403,
81 message: 'Cannot update video channel of another user'
82 })
83 }
84 68
85 return next() 69 return next()
86 } 70 }