Verified Commit 2c2befaa authored by Chocobozzz's avatar Chocobozzz
Browse files

Fix video right check

parent ff9d43f6
......@@ -47,7 +47,7 @@ function authenticateSocket (socket: Socket, next: (err?: any) => void) {
.catch(err => logger.error('Cannot get access token.', { err }))
}
function authenticatePromiseIfNeeded (req: express.Request, res: express.Response, authenticateInQuery = false) {
function authenticatePromise (req: express.Request, res: express.Response, authenticateInQuery = false) {
return new Promise<void>(resolve => {
// Already authenticated? (or tried to)
if (res.locals.oauth?.token.User) return resolve()
......@@ -76,6 +76,6 @@ function optionalAuthenticate (req: express.Request, res: express.Response, next
export {
authenticate,
authenticateSocket,
authenticatePromiseIfNeeded,
authenticatePromise,
optionalAuthenticate
}
......@@ -2,7 +2,7 @@ import { Request, Response } from 'express'
import { isUUIDValid } from '@server/helpers/custom-validators/misc'
import { loadVideo, VideoLoadType } from '@server/lib/model-loaders'
import { isAbleToUploadVideo } from '@server/lib/user'
import { authenticatePromiseIfNeeded } from '@server/middlewares/auth'
import { authenticatePromise } from '@server/middlewares/auth'
import { VideoModel } from '@server/models/video/video'
import { VideoChannelModel } from '@server/models/video/video-channel'
import { VideoFileModel } from '@server/models/video/video-file'
......@@ -137,7 +137,7 @@ async function checkCanSeeAuthVideo (req: Request, res: Response, video: MVideoI
return false
}
await authenticatePromiseIfNeeded(req, res, authenticateInQuery)
await authenticatePromise(req, res, authenticateInQuery)
const user = res.locals.oauth?.token.User
if (!user) return fail()
......@@ -154,14 +154,15 @@ async function checkCanSeeAuthVideo (req: Request, res: Response, video: MVideoI
}
const isOwnedByUser = videoWithRights.VideoChannel.Account.userId === user.id
if (privacy === VideoPrivacy.PRIVATE || privacy === VideoPrivacy.UNLISTED) {
if (isOwnedByUser && user.hasRight(UserRight.SEE_ALL_VIDEOS)) return true
if (videoWithRights.isBlacklisted()) {
if (isOwnedByUser || user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) return true
return fail()
}
if (videoWithRights.isBlacklisted()) {
if (isOwnedByUser || user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) return true
if (privacy === VideoPrivacy.PRIVATE || privacy === VideoPrivacy.UNLISTED) {
if (isOwnedByUser || user.hasRight(UserRight.SEE_ALL_VIDEOS)) return true
return fail()
}
......
......@@ -33,7 +33,7 @@ import { logger } from '../../../helpers/logger'
import { CONSTRAINTS_FIELDS } from '../../../initializers/constants'
import { VideoPlaylistElementModel } from '../../../models/video/video-playlist-element'
import { MVideoPlaylist } from '../../../types/models/video/video-playlist'
import { authenticatePromiseIfNeeded } from '../../auth'
import { authenticatePromise } from '../../auth'
import {
areValidationErrors,
doesVideoChannelIdExist,
......@@ -161,7 +161,7 @@ const videoPlaylistsGetValidator = (fetchType: VideoPlaylistFetchType) => {
}
if (videoPlaylist.privacy === VideoPlaylistPrivacy.PRIVATE) {
await authenticatePromiseIfNeeded(req, res)
await authenticatePromise(req, res)
const user = res.locals.oauth ? res.locals.oauth.token.User : null
......
......@@ -162,7 +162,7 @@ describe('Test video privacy', function () {
})
it('Should not be able to get this unlisted video using its id', async function () {
await servers[1].videos.get({ id: unlistedVideo.id, expectedStatus: HttpStatusCode.NOT_FOUND_404 })
await servers[1].videos.get({ id: unlistedVideo.id, expectedStatus: HttpStatusCode.UNAUTHORIZED_401 })
})
it('Should be able to get this unlisted video using its uuid/shortUUID', async function () {
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment