From 45abb8b97b8313f8f58a4a73b527882ad7b4af9c Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Wed, 11 Jan 2017 18:41:09 +0100 Subject: Server: rights check for update a video --- server/middlewares/validators/videos.js | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'server/middlewares/validators') diff --git a/server/middlewares/validators/videos.js b/server/middlewares/validators/videos.js index ff18a99c2..3d7c04b60 100644 --- a/server/middlewares/validators/videos.js +++ b/server/middlewares/validators/videos.js @@ -53,6 +53,14 @@ function videosUpdate (req, res, next) { logger.debug('Checking videosUpdate parameters', { parameters: req.body }) checkErrors(req, res, function () { + if (res.locals.video.isOwned() === false) { + return res.status(403).send('Cannot update video of another pod') + } + + if (res.locals.video.Author.userId !== res.locals.oauth.token.User.id) { + return res.status(403).send('Cannot update video of another user') + } + checkVideoExists(req.params.id, res, next) }) } -- cgit v1.2.3