forks/peertube
1
0
Fork 0
Code Releases Activity

Server: rights check for update a video

Browse source
This commit is contained in:
Chocobozzz 2017-01-11 18:41:09 +01:00
parent d8cc063e97
commit 45abb8b97b
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
server/middlewares/validators/videos.js
View file

@ -53,6 +53,14 @@ function videosUpdate (req, res, next) {
logger.debug('Checking videosUpdate parameters', { parameters: req.body })
checkErrors(req, res, function () {
if (res.locals.video.isOwned() === false) {
return res.status(403).send('Cannot update video of another pod')
}
if (res.locals.video.Author.userId !== res.locals.oauth.token.User.id) {
return res.status(403).send('Cannot update video of another user')
}
checkVideoExists(req.params.id, res, next)
})
}

4
server/tests/api/check-params/videos.js
View file

@ -378,6 +378,10 @@ describe('Test videos API validator', function () {
}
requestsUtils.makePutBodyRequest(server.url, path + videoId, server.accessToken, data, done)
})
it('Should fail with a video of another user')
it('Should fail with a video of another pod')
})
describe('When getting a video', function () {