From 8a6828b1664ce3fc535d23c54ed22bab35588d06 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Fri, 16 Sep 2022 10:58:13 +0200 Subject: Check channel sync id is owned by channel --- server/middlewares/validators/videos/video-channels.ts | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'server/middlewares') diff --git a/server/middlewares/validators/videos/video-channels.ts b/server/middlewares/validators/videos/video-channels.ts index 8338b24fc..ca6b57003 100644 --- a/server/middlewares/validators/videos/video-channels.ts +++ b/server/middlewares/validators/videos/video-channels.ts @@ -166,6 +166,13 @@ export const videoChannelImportVideosValidator = [ if (body.videoChannelSyncId && !await doesVideoChannelSyncIdExist(body.videoChannelSyncId, res)) return + if (res.locals.videoChannelSync && res.locals.videoChannelSync.videoChannelId !== res.locals.videoChannel.id) { + return res.fail({ + status: HttpStatusCode.FORBIDDEN_403, + message: 'This channel sync is not owned by this channel' + }) + } + return next() } ] -- cgit v1.2.3