From 2c2befaacaa7063df0d4557b71c187ee168a8eb6 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Wed, 22 Jun 2022 14:03:50 +0200 Subject: Fix video right check --- server/middlewares/validators/shared/videos.ts | 13 +++++++------ server/middlewares/validators/videos/video-playlists.ts | 4 ++-- 2 files changed, 9 insertions(+), 8 deletions(-) (limited to 'server/middlewares/validators') diff --git a/server/middlewares/validators/shared/videos.ts b/server/middlewares/validators/shared/videos.ts index 39aab6df7..2c2ae3811 100644 --- a/server/middlewares/validators/shared/videos.ts +++ b/server/middlewares/validators/shared/videos.ts @@ -2,7 +2,7 @@ import { Request, Response } from 'express' import { isUUIDValid } from '@server/helpers/custom-validators/misc' import { loadVideo, VideoLoadType } from '@server/lib/model-loaders' import { isAbleToUploadVideo } from '@server/lib/user' -import { authenticatePromiseIfNeeded } from '@server/middlewares/auth' +import { authenticatePromise } from '@server/middlewares/auth' import { VideoModel } from '@server/models/video/video' import { VideoChannelModel } from '@server/models/video/video-channel' import { VideoFileModel } from '@server/models/video/video-file' @@ -137,7 +137,7 @@ async function checkCanSeeAuthVideo (req: Request, res: Response, video: MVideoI return false } - await authenticatePromiseIfNeeded(req, res, authenticateInQuery) + await authenticatePromise(req, res, authenticateInQuery) const user = res.locals.oauth?.token.User if (!user) return fail() @@ -154,14 +154,15 @@ async function checkCanSeeAuthVideo (req: Request, res: Response, video: MVideoI } const isOwnedByUser = videoWithRights.VideoChannel.Account.userId === user.id - if (privacy === VideoPrivacy.PRIVATE || privacy === VideoPrivacy.UNLISTED) { - if (isOwnedByUser && user.hasRight(UserRight.SEE_ALL_VIDEOS)) return true + + if (videoWithRights.isBlacklisted()) { + if (isOwnedByUser || user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) return true return fail() } - if (videoWithRights.isBlacklisted()) { - if (isOwnedByUser || user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) return true + if (privacy === VideoPrivacy.PRIVATE || privacy === VideoPrivacy.UNLISTED) { + if (isOwnedByUser || user.hasRight(UserRight.SEE_ALL_VIDEOS)) return true return fail() } diff --git a/server/middlewares/validators/videos/video-playlists.ts b/server/middlewares/validators/videos/video-playlists.ts index 241b9ed7b..d514ae0ad 100644 --- a/server/middlewares/validators/videos/video-playlists.ts +++ b/server/middlewares/validators/videos/video-playlists.ts @@ -33,7 +33,7 @@ import { logger } from '../../../helpers/logger' import { CONSTRAINTS_FIELDS } from '../../../initializers/constants' import { VideoPlaylistElementModel } from '../../../models/video/video-playlist-element' import { MVideoPlaylist } from '../../../types/models/video/video-playlist' -import { authenticatePromiseIfNeeded } from '../../auth' +import { authenticatePromise } from '../../auth' import { areValidationErrors, doesVideoChannelIdExist, @@ -161,7 +161,7 @@ const videoPlaylistsGetValidator = (fetchType: VideoPlaylistFetchType) => { } if (videoPlaylist.privacy === VideoPlaylistPrivacy.PRIVATE) { - await authenticatePromiseIfNeeded(req, res) + await authenticatePromise(req, res) const user = res.locals.oauth ? res.locals.oauth.token.User : null -- cgit v1.2.3