From 2f0a0ae21789ada8429c91a253288f738857a19b Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Tue, 18 Jan 2022 09:29:46 +0100
Subject: Upgrade uploadx dependency

---
 server/controllers/api/videos/upload.ts        |  5 +----
 server/lib/uploadx.ts                          |  8 ++++++--
 server/middlewares/validators/videos/videos.ts | 17 -----------------
 3 files changed, 7 insertions(+), 23 deletions(-)

(limited to 'server')

diff --git a/server/controllers/api/videos/upload.ts b/server/controllers/api/videos/upload.ts
index 89787f20b..fd90d9915 100644
--- a/server/controllers/api/videos/upload.ts
+++ b/server/controllers/api/videos/upload.ts
@@ -40,8 +40,7 @@ import {
   authenticate,
   videosAddLegacyValidator,
   videosAddResumableInitValidator,
-  videosAddResumableValidator,
-  videosResumableUploadIdValidator
+  videosAddResumableValidator
 } from '../../../middlewares'
 import { ScheduleVideoUpdateModel } from '../../../models/video/schedule-video-update'
 import { VideoModel } from '../../../models/video/video'
@@ -88,7 +87,6 @@ uploadRouter.post('/upload-resumable',
 
 uploadRouter.delete('/upload-resumable',
   authenticate,
-  videosResumableUploadIdValidator,
   asyncMiddleware(deleteUploadResumableCache),
   uploadx.upload
 )
@@ -96,7 +94,6 @@ uploadRouter.delete('/upload-resumable',
 uploadRouter.put('/upload-resumable',
   openapiOperationDoc({ operationId: 'uploadResumable' }),
   authenticate,
-  videosResumableUploadIdValidator,
   uploadx.upload, // uploadx doesn't next() before the file upload completes
   asyncMiddleware(videosAddResumableValidator),
   asyncMiddleware(addVideoResumable)
diff --git a/server/lib/uploadx.ts b/server/lib/uploadx.ts
index 36f5a556c..34a4461f0 100644
--- a/server/lib/uploadx.ts
+++ b/server/lib/uploadx.ts
@@ -5,9 +5,13 @@ import { Uploadx } from '@uploadx/core'
 const uploadx = new Uploadx({
   directory: getResumableUploadPath(),
   // Could be big with thumbnails/previews
-  maxMetadataSize: '10MB'
+  maxMetadataSize: '10MB',
+  userIdentifier: (_, res: express.Response) => {
+    if (!res.locals.oauth) return undefined
+
+    return res.locals.oauth.token.user.id + ''
+  }
 })
-uploadx.getUserId = (_, res: express.Response) => res.locals.oauth?.token.user.id
 
 export {
   uploadx
diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts
index 3a1a905f3..b3ffb7007 100644
--- a/server/middlewares/validators/videos/videos.ts
+++ b/server/middlewares/validators/videos/videos.ts
@@ -102,22 +102,6 @@ const videosAddLegacyValidator = getCommonVideoEditAttributes().concat([
   }
 ])
 
-const videosResumableUploadIdValidator = [
-  (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    const user = res.locals.oauth.token.User
-    const uploadId = req.query.upload_id
-
-    if (uploadId.startsWith(user.id + '-') !== true) {
-      return res.fail({
-        status: HttpStatusCode.FORBIDDEN_403,
-        message: 'You cannot send chunks in another user upload'
-      })
-    }
-
-    return next()
-  }
-]
-
 /**
  * Gets called after the last PUT request
  */
@@ -566,7 +550,6 @@ export {
   videosAddLegacyValidator,
   videosAddResumableValidator,
   videosAddResumableInitValidator,
-  videosResumableUploadIdValidator,
 
   videosUpdateValidator,
   videosGetValidator,
-- 
cgit v1.2.3