From ff9d43f62a4f4737c5bfe955883b48c5440f323a Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Wed, 22 Jun 2022 09:44:08 +0200 Subject: Refactor video rights checker --- .../validators/videos/video-captions.ts | 4 ++-- .../validators/videos/video-comments.ts | 10 ++++---- .../middlewares/validators/videos/video-rates.ts | 4 ++-- server/middlewares/validators/videos/videos.ts | 28 ++++------------------ 4 files changed, 13 insertions(+), 33 deletions(-) (limited to 'server/middlewares/validators/videos') diff --git a/server/middlewares/validators/videos/video-captions.ts b/server/middlewares/validators/videos/video-captions.ts index 441c6b4be..dfb8fefc5 100644 --- a/server/middlewares/validators/videos/video-captions.ts +++ b/server/middlewares/validators/videos/video-captions.ts @@ -7,7 +7,7 @@ import { logger } from '../../../helpers/logger' import { CONSTRAINTS_FIELDS, MIMETYPES } from '../../../initializers/constants' import { areValidationErrors, - checkCanSeeVideoIfPrivate, + checkCanSeeVideo, checkUserCanManageVideo, doesVideoCaptionExist, doesVideoExist, @@ -74,7 +74,7 @@ const listVideoCaptionsValidator = [ if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return const video = res.locals.onlyVideo - if (!await checkCanSeeVideoIfPrivate(req, res, video)) return + if (!await checkCanSeeVideo({ req, res, video, paramId: req.params.videoId })) return return next() } diff --git a/server/middlewares/validators/videos/video-comments.ts b/server/middlewares/validators/videos/video-comments.ts index 698afdbd1..b22a4e3b7 100644 --- a/server/middlewares/validators/videos/video-comments.ts +++ b/server/middlewares/validators/videos/video-comments.ts @@ -10,7 +10,7 @@ import { Hooks } from '../../../lib/plugins/hooks' import { MCommentOwnerVideoReply, MVideo, MVideoFullLight } from '../../../types/models/video' import { areValidationErrors, - checkCanSeeVideoIfPrivate, + checkCanSeeVideo, doesVideoCommentExist, doesVideoCommentThreadExist, doesVideoExist, @@ -54,7 +54,7 @@ const listVideoCommentThreadsValidator = [ if (areValidationErrors(req, res)) return if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return - if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.onlyVideo)) return + if (!await checkCanSeeVideo({ req, res, paramId: req.params.videoId, video: res.locals.onlyVideo })) return return next() } @@ -73,7 +73,7 @@ const listVideoThreadCommentsValidator = [ if (!await doesVideoExist(req.params.videoId, res, 'only-video')) return if (!await doesVideoCommentThreadExist(req.params.threadId, res.locals.onlyVideo, res)) return - if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.onlyVideo)) return + if (!await checkCanSeeVideo({ req, res, paramId: req.params.videoId, video: res.locals.onlyVideo })) return return next() } @@ -91,7 +91,7 @@ const addVideoCommentThreadValidator = [ if (areValidationErrors(req, res)) return if (!await doesVideoExist(req.params.videoId, res)) return - if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) return + if (!await checkCanSeeVideo({ req, res, paramId: req.params.videoId, video: res.locals.videoAll })) return if (!isVideoCommentsEnabled(res.locals.videoAll, res)) return if (!await isVideoCommentAccepted(req, res, res.locals.videoAll, false)) return @@ -113,7 +113,7 @@ const addVideoCommentReplyValidator = [ if (areValidationErrors(req, res)) return if (!await doesVideoExist(req.params.videoId, res)) return - if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) return + if (!await checkCanSeeVideo({ req, res, paramId: req.params.videoId, video: res.locals.videoAll })) return if (!isVideoCommentsEnabled(res.locals.videoAll, res)) return if (!await doesVideoCommentExist(req.params.commentId, res.locals.videoAll, res)) return diff --git a/server/middlewares/validators/videos/video-rates.ts b/server/middlewares/validators/videos/video-rates.ts index 1a9736034..8b8eeedb6 100644 --- a/server/middlewares/validators/videos/video-rates.ts +++ b/server/middlewares/validators/videos/video-rates.ts @@ -8,7 +8,7 @@ import { isRatingValid } from '../../../helpers/custom-validators/video-rates' import { isVideoRatingTypeValid } from '../../../helpers/custom-validators/videos' import { logger } from '../../../helpers/logger' import { AccountVideoRateModel } from '../../../models/account/account-video-rate' -import { areValidationErrors, checkCanSeeVideoIfPrivate, doesVideoExist, isValidVideoIdParam } from '../shared' +import { areValidationErrors, checkCanSeeVideo, doesVideoExist, isValidVideoIdParam } from '../shared' const videoUpdateRateValidator = [ isValidVideoIdParam('id'), @@ -21,7 +21,7 @@ const videoUpdateRateValidator = [ if (areValidationErrors(req, res)) return if (!await doesVideoExist(req.params.id, res)) return - if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) return + if (!await checkCanSeeVideo({ req, res, paramId: req.params.id, video: res.locals.videoAll })) return return next() } diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts index c75c3640b..c6d31f8f0 100644 --- a/server/middlewares/validators/videos/videos.ts +++ b/server/middlewares/validators/videos/videos.ts @@ -7,14 +7,13 @@ import { getServerActor } from '@server/models/application/application' import { ExpressPromiseHandler } from '@server/types/express-handler' import { MUserAccountId, MVideoFullLight } from '@server/types/models' import { getAllPrivacies } from '@shared/core-utils' -import { HttpStatusCode, ServerErrorCode, UserRight, VideoInclude, VideoPrivacy } from '@shared/models' +import { HttpStatusCode, ServerErrorCode, UserRight, VideoInclude } from '@shared/models' import { exists, isBooleanValid, isDateValid, isFileValid, isIdValid, - isUUIDValid, toArray, toBooleanOrNull, toIntOrNull, @@ -50,7 +49,7 @@ import { Hooks } from '../../../lib/plugins/hooks' import { VideoModel } from '../../../models/video/video' import { areValidationErrors, - checkCanSeePrivateVideo, + checkCanSeeVideo, checkUserCanManageVideo, checkUserQuota, doesVideoChannelOfAccountExist, @@ -297,28 +296,9 @@ const videosCustomGetValidator = ( const video = getVideoWithAttributes(res) as MVideoFullLight - // Video private or blacklisted - if (video.requiresAuth()) { - if (await checkCanSeePrivateVideo(req, res, video, authenticateInQuery)) { - return next() - } + if (!await checkCanSeeVideo({ req, res, video, paramId: req.params.id, authenticateInQuery })) return - return - } - - // Video is public, anyone can access it - if (video.privacy === VideoPrivacy.PUBLIC) return next() - - // Video is unlisted, check we used the uuid to fetch it - if (video.privacy === VideoPrivacy.UNLISTED) { - if (isUUIDValid(req.params.id)) return next() - - // Don't leak this unlisted video - return res.fail({ - status: HttpStatusCode.NOT_FOUND_404, - message: 'Video not found' - }) - } + return next() } ] } -- cgit v1.2.3