From d7df188f23bb3c4773ac26e6fa8b3d82b1229e6d Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Thu, 25 Feb 2021 11:17:53 +0100 Subject: Fix separate SQL query for video get --- server/middlewares/validators/videos/videos.ts | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'server/middlewares') diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts index be05b2a69..d51c86972 100644 --- a/server/middlewares/validators/videos/videos.ts +++ b/server/middlewares/validators/videos/videos.ts @@ -3,7 +3,7 @@ import { body, param, query, ValidationChain } from 'express-validator' import { isAbleToUploadVideo } from '@server/lib/user' import { getServerActor } from '@server/models/application/application' import { ExpressPromiseHandler } from '@server/types/express' -import { MVideoFullLight } from '@server/types/models' +import { MVideoFullLight, MVideoWithRights } from '@server/types/models' import { ServerErrorCode, UserRight, VideoChangeOwnershipStatus, VideoPrivacy } from '../../../../shared' import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes' import { VideoChangeOwnershipAccept } from '../../../../shared/models/videos/video-change-ownership-accept.model' @@ -197,17 +197,16 @@ const videosCustomGetValidator = ( // Controllers does not need to check video rights if (fetchType === 'only-immutable-attributes') return next() - const video = getVideoWithAttributes(res) - const videoAll = video as MVideoFullLight + const video = getVideoWithAttributes(res) as MVideoWithRights // Video private or blacklisted - if (videoAll.requiresAuth()) { + if (video.requiresAuth()) { await authenticatePromiseIfNeeded(req, res, authenticateInQuery) const user = res.locals.oauth ? res.locals.oauth.token.User : null // Only the owner or a user that have blacklist rights can see the video - if (!user || !user.canGetVideo(videoAll)) { + if (!user || !user.canGetVideo(video)) { return res.status(HttpStatusCode.FORBIDDEN_403) .json({ error: 'Cannot get this private/internal or blacklisted video.' }) } -- cgit v1.2.3