diff --git a/server/lib/activitypub/process/process-update.ts b/server/lib/activitypub/process/process-update.ts index 6d2fff3fe..849f70b94 100644 --- a/server/lib/activitypub/process/process-update.ts +++ b/server/lib/activitypub/process/process-update.ts @@ -62,7 +62,15 @@ async function processUpdateVideo (actor: MActorSignature, activity: ActivityUpd return undefined } - const { video } = await getOrCreateVideoAndAccountAndChannel({ videoObject: videoObject.id, allowRefresh: false, fetchType: 'all' }) + const { video, created } = await getOrCreateVideoAndAccountAndChannel({ + videoObject: videoObject.id, + allowRefresh: false, + fetchType: 'all' + }) + // We did not have this video, it has been created so no need to update + if (created) return + + // Load new channel const channelActor = await getOrCreateVideoChannelFromVideoObject(videoObject) const account = actor.Account as MAccountIdActor diff --git a/server/lib/activitypub/videos.ts b/server/lib/activitypub/videos.ts index c38edad56..c29bcc528 100644 --- a/server/lib/activitypub/videos.ts +++ b/server/lib/activitypub/videos.ts @@ -336,10 +336,15 @@ async function updateVideoFromAP (options: { videoFieldsSave = video.toJSON() - // Check actor has the right to update the video - const videoChannel = video.VideoChannel - if (videoChannel.Account.id !== account.id) { - throw new Error('Account ' + account.Actor.url + ' does not own video channel ' + videoChannel.Actor.url) + // Check we can update the channel: we trust the remote server + const oldVideoChannel = video.VideoChannel + + if (!oldVideoChannel.Actor.serverId || !channel.Actor.serverId) { + throw new Error('Cannot check old channel/new channel validity because `serverId` is null') + } + + if (oldVideoChannel.Actor.serverId !== channel.Actor.serverId) { + throw new Error('New channel ' + channel.Actor.url + ' is not on the same server than new channel ' + oldVideoChannel.Actor.url) } const to = overrideTo || videoObject.to