From 795212f7acc690c88c86d0fab8772f6564d59cb8 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Thu, 6 Jan 2022 13:27:29 +0100 Subject: Prevent caption listing of private videos --- .../validators/videos/video-captions.ts | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) (limited to 'server/middlewares/validators/videos/video-captions.ts') diff --git a/server/middlewares/validators/videos/video-captions.ts b/server/middlewares/validators/videos/video-captions.ts index 38321ccf9..4fc4c8ec5 100644 --- a/server/middlewares/validators/videos/video-captions.ts +++ b/server/middlewares/validators/videos/video-captions.ts @@ -1,11 +1,18 @@ import express from 'express' import { body, param } from 'express-validator' -import { UserRight } from '../../../../shared' +import { HttpStatusCode, UserRight } from '../../../../shared' import { isVideoCaptionFile, isVideoCaptionLanguageValid } from '../../../helpers/custom-validators/video-captions' import { cleanUpReqFiles } from '../../../helpers/express-utils' import { logger } from '../../../helpers/logger' import { CONSTRAINTS_FIELDS, MIMETYPES } from '../../../initializers/constants' -import { areValidationErrors, checkUserCanManageVideo, doesVideoCaptionExist, doesVideoExist, isValidVideoIdParam } from '../shared' +import { + areValidationErrors, + checkCanSeeVideoIfPrivate, + checkUserCanManageVideo, + doesVideoCaptionExist, + doesVideoExist, + isValidVideoIdParam +} from '../shared' const addVideoCaptionValidator = [ isValidVideoIdParam('videoId'), @@ -64,7 +71,16 @@ const listVideoCaptionsValidator = [ logger.debug('Checking listVideoCaptions parameters', { parameters: req.params }) if (areValidationErrors(req, res)) return - if (!await doesVideoExist(req.params.videoId, res, 'id')) return + if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return + + const video = res.locals.onlyVideo + + if (!await checkCanSeeVideoIfPrivate(req, res, video)) { + return res.fail({ + status: HttpStatusCode.FORBIDDEN_403, + message: 'Cannot list captions of private/internal/blocklisted video' + }) + } return next() } -- cgit v1.2.3