From 795212f7acc690c88c86d0fab8772f6564d59cb8 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Thu, 6 Jan 2022 13:27:29 +0100 Subject: Prevent caption listing of private videos --- server/controllers/api/videos/captions.ts | 2 +- server/controllers/api/videos/files.ts | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) (limited to 'server/controllers/api/videos') diff --git a/server/controllers/api/videos/captions.ts b/server/controllers/api/videos/captions.ts index 2d2213327..aa7259ee9 100644 --- a/server/controllers/api/videos/captions.ts +++ b/server/controllers/api/videos/captions.ts @@ -48,7 +48,7 @@ export { // --------------------------------------------------------------------------- async function listVideoCaptions (req: express.Request, res: express.Response) { - const data = await VideoCaptionModel.listVideoCaptions(res.locals.videoId.id) + const data = await VideoCaptionModel.listVideoCaptions(res.locals.onlyVideo.id) return res.json(getFormattedObjects(data, data.length)) } diff --git a/server/controllers/api/videos/files.ts b/server/controllers/api/videos/files.ts index a8b32411d..0fbda280e 100644 --- a/server/controllers/api/videos/files.ts +++ b/server/controllers/api/videos/files.ts @@ -10,13 +10,15 @@ import { ensureUserHasRight, videoFileMetadataGetValidator, videoFilesDeleteHLSValidator, - videoFilesDeleteWebTorrentValidator + videoFilesDeleteWebTorrentValidator, + videosGetValidator } from '../../../middlewares' const lTags = loggerTagsFactory('api', 'video') const filesRouter = express.Router() filesRouter.get('/:id/metadata/:videoFileId', + asyncMiddleware(videosGetValidator), asyncMiddleware(videoFileMetadataGetValidator), asyncMiddleware(getVideoFileMetadata) ) -- cgit v1.2.3