From b3d9dedcc36a333bae0bafe92eeede1a11796ce7 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Mon, 2 May 2022 14:57:37 +0200 Subject: [PATCH] Allow oembed to fetch unlisted videos --- server/middlewares/validators/oembed.ts | 36 +++++++----- server/tests/api/check-params/services.ts | 67 ++++++++++++++++++++++- 2 files changed, 87 insertions(+), 16 deletions(-) diff --git a/server/middlewares/validators/oembed.ts b/server/middlewares/validators/oembed.ts index 32dd05271..fc1a294e0 100644 --- a/server/middlewares/validators/oembed.ts +++ b/server/middlewares/validators/oembed.ts @@ -6,7 +6,7 @@ import { VideoPlaylistModel } from '@server/models/video/video-playlist' import { VideoPlaylistPrivacy, VideoPrivacy } from '@shared/models' import { HttpStatusCode } from '../../../shared/models/http/http-error-codes' import { isTestInstance } from '../../helpers/core-utils' -import { isIdOrUUIDValid, toCompleteUUID } from '../../helpers/custom-validators/misc' +import { isIdOrUUIDValid, isUUIDValid, toCompleteUUID } from '../../helpers/custom-validators/misc' import { logger } from '../../helpers/logger' import { WEBSERVER } from '../../initializers/constants' import { areValidationErrors } from './shared' @@ -107,15 +107,18 @@ const oembedValidator = [ }) } - if (video.privacy !== VideoPrivacy.PUBLIC) { - return res.fail({ - status: HttpStatusCode.FORBIDDEN_403, - message: 'Video is not public' - }) + if ( + video.privacy === VideoPrivacy.PUBLIC || + (video.privacy === VideoPrivacy.UNLISTED && isUUIDValid(elementId) === true) + ) { + res.locals.videoAll = video + return next() } - res.locals.videoAll = video - return next() + return res.fail({ + status: HttpStatusCode.FORBIDDEN_403, + message: 'Video is not publicly available' + }) } // Is playlist @@ -128,15 +131,18 @@ const oembedValidator = [ }) } - if (videoPlaylist.privacy !== VideoPlaylistPrivacy.PUBLIC) { - return res.fail({ - status: HttpStatusCode.FORBIDDEN_403, - message: 'Playlist is not public' - }) + if ( + videoPlaylist.privacy === VideoPlaylistPrivacy.PUBLIC || + (videoPlaylist.privacy === VideoPlaylistPrivacy.UNLISTED && isUUIDValid(elementId)) + ) { + res.locals.videoPlaylistSummary = videoPlaylist + return next() } - res.locals.videoPlaylistSummary = videoPlaylist - return next() + return res.fail({ + status: HttpStatusCode.FORBIDDEN_403, + message: 'Playlist is not public' + }) } ] diff --git a/server/tests/api/check-params/services.ts b/server/tests/api/check-params/services.ts index e63f09884..5d1713e03 100644 --- a/server/tests/api/check-params/services.ts +++ b/server/tests/api/check-params/services.ts @@ -1,6 +1,7 @@ /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */ import 'mocha' +import { HttpStatusCode, VideoCreateResult, VideoPlaylistCreateResult, VideoPlaylistPrivacy, VideoPrivacy } from '@shared/models' import { cleanupTests, createSingleServer, @@ -9,12 +10,17 @@ import { setAccessTokensToServers, setDefaultVideoChannel } from '@shared/server-commands' -import { HttpStatusCode, VideoPlaylistPrivacy } from '@shared/models' describe('Test services API validators', function () { let server: PeerTubeServer let playlistUUID: string + let privateVideo: VideoCreateResult + let unlistedVideo: VideoCreateResult + + let privatePlaylist: VideoPlaylistCreateResult + let unlistedPlaylist: VideoPlaylistCreateResult + // --------------------------------------------------------------- before(async function () { @@ -26,6 +32,9 @@ describe('Test services API validators', function () { server.store.videoCreated = await server.videos.upload({ attributes: { name: 'my super name' } }) + privateVideo = await server.videos.quickUpload({ name: 'private', privacy: VideoPrivacy.PRIVATE }) + unlistedVideo = await server.videos.quickUpload({ name: 'unlisted', privacy: VideoPrivacy.UNLISTED }) + { const created = await server.playlists.create({ attributes: { @@ -36,6 +45,22 @@ describe('Test services API validators', function () { }) playlistUUID = created.uuid + + privatePlaylist = await server.playlists.create({ + attributes: { + displayName: 'private', + privacy: VideoPlaylistPrivacy.PRIVATE, + videoChannelId: server.store.channel.id + } + }) + + unlistedPlaylist = await server.playlists.create({ + attributes: { + displayName: 'unlisted', + privacy: VideoPlaylistPrivacy.UNLISTED, + videoChannelId: server.store.channel.id + } + }) } }) @@ -91,6 +116,46 @@ describe('Test services API validators', function () { await checkParamEmbed(server, embedUrl, HttpStatusCode.NOT_IMPLEMENTED_501, { format: 'xml' }) }) + it('Should fail with a private video', async function () { + const embedUrl = `http://localhost:${server.port}/videos/watch/${privateVideo.uuid}` + + await checkParamEmbed(server, embedUrl, HttpStatusCode.FORBIDDEN_403) + }) + + it('Should fail with an unlisted video with the int id', async function () { + const embedUrl = `http://localhost:${server.port}/videos/watch/${unlistedVideo.id}` + + await checkParamEmbed(server, embedUrl, HttpStatusCode.FORBIDDEN_403) + }) + + it('Should succeed with an unlisted video using the uuid id', async function () { + for (const uuid of [ unlistedVideo.uuid, unlistedVideo.shortUUID ]) { + const embedUrl = `http://localhost:${server.port}/videos/watch/${uuid}` + + await checkParamEmbed(server, embedUrl, HttpStatusCode.OK_200) + } + }) + + it('Should fail with a private playlist', async function () { + const embedUrl = `http://localhost:${server.port}/videos/watch/playlist/${privatePlaylist.uuid}` + + await checkParamEmbed(server, embedUrl, HttpStatusCode.FORBIDDEN_403) + }) + + it('Should fail with an unlisted playlist using the int id', async function () { + const embedUrl = `http://localhost:${server.port}/videos/watch/playlist/${unlistedPlaylist.id}` + + await checkParamEmbed(server, embedUrl, HttpStatusCode.FORBIDDEN_403) + }) + + it('Should succeed with an unlisted playlist using the uuid id', async function () { + for (const uuid of [ unlistedPlaylist.uuid, unlistedPlaylist.shortUUID ]) { + const embedUrl = `http://localhost:${server.port}/videos/watch/playlist/${uuid}` + + await checkParamEmbed(server, embedUrl, HttpStatusCode.OK_200) + } + }) + it('Should succeed with the correct params with a video', async function () { const embedUrl = `http://localhost:${server.port}/videos/watch/${server.store.videoCreated.uuid}` const query = {