From 68b6fd21b19ef17274e84dbb21ad7cfb7bc6c36a Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Tue, 21 Apr 2020 09:01:39 +0200
Subject: Don't leak unlisted videos in comments feed

---
 server/controllers/feeds.ts          |  4 ++--
 server/models/video/video-comment.ts |  6 +++++-
 server/tests/feeds/feeds.ts          | 12 +++++++++++-
 3 files changed, 18 insertions(+), 4 deletions(-)

(limited to 'server')

diff --git a/server/controllers/feeds.ts b/server/controllers/feeds.ts
index 72628dffb..cb82bfc6d 100644
--- a/server/controllers/feeds.ts
+++ b/server/controllers/feeds.ts
@@ -67,7 +67,7 @@ async function generateVideoCommentsFeed (req: express.Request, res: express.Res
   const feed = initFeed(name, description)
 
   // Adding video items to the feed, one at a time
-  comments.forEach(comment => {
+  for (const comment of comments) {
     const link = WEBSERVER.URL + comment.getCommentStaticPath()
 
     let title = comment.Video.name
@@ -89,7 +89,7 @@ async function generateVideoCommentsFeed (req: express.Request, res: express.Res
       author,
       date: comment.createdAt
     })
-  })
+  }
 
   // Now the feed generation is done, let's send it!
   return sendFeed(feed, req, res)
diff --git a/server/models/video/video-comment.ts b/server/models/video/video-comment.ts
index b33c33d5e..aedd7a3a9 100644
--- a/server/models/video/video-comment.ts
+++ b/server/models/video/video-comment.ts
@@ -27,6 +27,7 @@ import {
   MCommentOwnerVideoReply
 } from '../../typings/models/video'
 import { MUserAccountId } from '@server/typings/models'
+import { VideoPrivacy } from '@shared/models'
 
 enum ScopeNames {
   WITH_ACCOUNT = 'WITH_ACCOUNT',
@@ -390,7 +391,10 @@ export class VideoCommentModel extends Model<VideoCommentModel> {
         {
           attributes: [ 'name', 'uuid' ],
           model: VideoModel.unscoped(),
-          required: true
+          required: true,
+          where: {
+            privacy: VideoPrivacy.PUBLIC
+          }
         }
       ]
     }
diff --git a/server/tests/feeds/feeds.ts b/server/tests/feeds/feeds.ts
index 4510177cc..d978123cf 100644
--- a/server/tests/feeds/feeds.ts
+++ b/server/tests/feeds/feeds.ts
@@ -19,6 +19,7 @@ import * as libxmljs from 'libxmljs'
 import { addVideoCommentThread } from '../../../shared/extra-utils/videos/video-comments'
 import { waitJobs } from '../../../shared/extra-utils/server/jobs'
 import { User } from '../../../shared/models/users'
+import { VideoPrivacy } from '@shared/models'
 
 chai.use(require('chai-xml'))
 chai.use(require('chai-json-schema'))
@@ -77,6 +78,14 @@ describe('Test syndication feeds', () => {
       await addVideoCommentThread(servers[0].url, servers[0].accessToken, videoId, 'super comment 2')
     }
 
+    {
+      const videoAttributes = { name: 'unlisted video', privacy: VideoPrivacy.UNLISTED }
+      const res = await uploadVideo(servers[0].url, servers[0].accessToken, videoAttributes)
+      const videoId = res.body.video.id
+
+      await addVideoCommentThread(servers[0].url, servers[0].accessToken, videoId, 'comment on unlisted video')
+    }
+
     await waitJobs(servers)
   })
 
@@ -196,7 +205,8 @@ describe('Test syndication feeds', () => {
   })
 
   describe('Video comments feed', function () {
-    it('Should contain valid comments (covers JSON feed 1.0 endpoint)', async function () {
+
+    it('Should contain valid comments (covers JSON feed 1.0 endpoint) and not from unlisted videos', async function () {
       for (const server of servers) {
         const json = await getJSONfeed(server.url, 'video-comments')
 
-- 
cgit v1.2.3