Compare commits

...

4 commits

Author SHA1 Message Date
kontrollanten 070f1bf67c
Merge c7c8d3b355 into 1642c5b9e7 2024-04-26 16:29:22 +02:00
Chocobozzz 1642c5b9e7
Protect all video related AP endpoints 2024-04-26 15:29:52 +02:00
Chocobozzz d72ef2a2b9
Fix federation when updating video privacy 2024-04-26 10:30:43 +02:00
kontrollanten c7c8d3b355 fix(server/plugins): avoid duplicate settings
Filter settings so that the name property is unique.

closes #6356
2024-04-26 10:03:03 +02:00
12 changed files with 111 additions and 35 deletions

View file

@ -1,5 +1,24 @@
async function register ({ registerHook, registerSetting, settingsManager, storageManager, peertubeHelpers }) {
{
registerSetting({
name: 'unique-setting',
label: 'Unique setting',
type: 'select',
options: []
})
registerSetting({
name: 'unique-setting',
label: 'Unique setting',
type: 'select',
options: [
{
value: 1,
label: 'One'
}
]
})
const actionHooks = [
'action:application.listening',
'action:notifier.notification.created',

View file

@ -5,6 +5,7 @@ import './html-injection'
import './id-and-pass-auth'
import './plugin-helpers'
import './plugin-router'
import './plugin-settings'
import './plugin-storage'
import './plugin-transcoding'
import './plugin-unloading'

View file

@ -0,0 +1,48 @@
/* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
import { expect } from 'chai'
import {
cleanupTests,
createSingleServer,
PeerTubeServer,
PluginsCommand,
setAccessTokensToServers
} from '@peertube/peertube-server-commands'
describe('Test plugin settings', function () {
let server: PeerTubeServer
let command: PluginsCommand
before(async function () {
this.timeout(30000)
server = await createSingleServer(1)
await setAccessTokensToServers([ server ])
command = server.plugins
await command.install({
path: PluginsCommand.getPluginTestPath()
})
})
it('Should not have duplicate settings', async function () {
const { registeredSettings } = await command.getRegisteredSettings({
npmName: 'peertube-plugin-test'
})
expect(registeredSettings.length).to.equal(1)
})
it('Should return the latest registered settings', async function () {
const { registeredSettings } = await command.getRegisteredSettings({
npmName: 'peertube-plugin-test'
})
expect(registeredSettings[0].options.length).length.to.equal(1)
})
after(async function () {
await cleanupTests([ server ])
})
})

View file

@ -192,7 +192,7 @@ async function updateVideoPrivacy (options: {
transaction: Transaction
}) {
const { videoInstance, videoInfoToUpdate, hadPrivacyForFederation, transaction } = options
const isNewVideoForFederation = isNewVideoPrivacyForFederation(videoInfoToUpdate.privacy, videoInfoToUpdate.privacy)
const isNewVideoForFederation = isNewVideoPrivacyForFederation(videoInstance.privacy, videoInfoToUpdate.privacy)
const newPrivacy = forceNumber(videoInfoToUpdate.privacy) as VideoPrivacyType
setVideoPrivacy(videoInstance, newPrivacy)

View file

@ -44,7 +44,7 @@ export class RegisterHelpers {
}[]
} = {}
private readonly settings: RegisterServerSettingOptions[] = []
private settings: RegisterServerSettingOptions[] = []
private idAndPassAuths: RegisterServerAuthPassOptions[] = []
private externalAuths: RegisterServerAuthExternalOptions[] = []
@ -203,7 +203,10 @@ export class RegisterHelpers {
private buildRegisterSetting () {
return (options: RegisterServerSettingOptions) => {
this.settings.push(options)
this.settings = [
...this.settings.filter((s) => s.name !== options.name),
options
]
}
}

View file

@ -16,6 +16,7 @@ import { isHostValid } from '../../helpers/custom-validators/servers.js'
import { VideoRedundancyModel } from '../../models/redundancy/video-redundancy.js'
import { ServerModel } from '../../models/server/server.js'
import { areValidationErrors, doesVideoExist, isValidVideoIdParam } from './shared/index.js'
import { canVideoBeFederated } from '@server/lib/activitypub/videos/federate.js'
const videoFileRedundancyGetValidator = [
isValidVideoIdParam('videoId'),
@ -31,6 +32,7 @@ const videoFileRedundancyGetValidator = [
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
if (areValidationErrors(req, res)) return
if (!await doesVideoExist(req.params.videoId, res)) return
if (!canVideoBeFederated(res.locals.onlyVideo)) return res.sendStatus(HttpStatusCode.NOT_FOUND_404)
const video = res.locals.videoAll
@ -72,6 +74,7 @@ const videoPlaylistRedundancyGetValidator = [
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
if (areValidationErrors(req, res)) return
if (!await doesVideoExist(req.params.videoId, res)) return
if (!canVideoBeFederated(res.locals.onlyVideo)) return res.sendStatus(HttpStatusCode.NOT_FOUND_404)
const video = res.locals.videoAll

View file

@ -18,7 +18,7 @@ import {
MVideoFullLight,
MVideoId,
MVideoImmutable,
MVideoThumbnail,
MVideoThumbnailBlacklist,
MVideoUUID,
MVideoWithRights
} from '@server/types/models/index.js'
@ -56,7 +56,7 @@ export async function doesVideoExist (id: number | string, res: Response, fetchT
break
case 'only-video-and-blacklist':
res.locals.onlyVideo = video as MVideoThumbnail
res.locals.onlyVideo = video as MVideoThumbnailBlacklist
break
}

View file

@ -1,19 +1,19 @@
import { HttpStatusCode } from '@peertube/peertube-models'
import { exists, isSafePeerTubeFilenameWithoutExtension, isUUIDValid, toBooleanOrNull } from '@server/helpers/custom-validators/misc.js'
import { logger } from '@server/helpers/logger.js'
import { LRU_CACHE } from '@server/initializers/constants.js'
import { VideoFileModel } from '@server/models/video/video-file.js'
import { VideoModel } from '@server/models/video/video.js'
import { MStreamingPlaylist, MVideoFile, MVideoThumbnailBlacklist } from '@server/types/models/index.js'
import express from 'express'
import { query } from 'express-validator'
import { LRUCache } from 'lru-cache'
import { basename, dirname } from 'path'
import { exists, isSafePeerTubeFilenameWithoutExtension, isUUIDValid, toBooleanOrNull } from '@server/helpers/custom-validators/misc.js'
import { logger } from '@server/helpers/logger.js'
import { LRU_CACHE } from '@server/initializers/constants.js'
import { VideoModel } from '@server/models/video/video.js'
import { VideoFileModel } from '@server/models/video/video-file.js'
import { MStreamingPlaylist, MVideoFile, MVideoThumbnail } from '@server/types/models/index.js'
import { HttpStatusCode } from '@peertube/peertube-models'
import { areValidationErrors, checkCanAccessVideoStaticFiles, isValidVideoPasswordHeader } from './shared/index.js'
type LRUValue = {
allowed: boolean
video?: MVideoThumbnail
video?: MVideoThumbnailBlacklist
file?: MVideoFile
playlist?: MStreamingPlaylist }
@ -122,8 +122,7 @@ const ensureCanAccessPrivateVideoHLSFiles = [
]
export {
ensureCanAccessVideoPrivateWebVideoFiles,
ensureCanAccessPrivateVideoHLSFiles
ensureCanAccessPrivateVideoHLSFiles, ensureCanAccessVideoPrivateWebVideoFiles
}
// ---------------------------------------------------------------------------
@ -139,7 +138,7 @@ async function isWebVideoAllowed (req: express.Request, res: express.Response) {
return { allowed: false }
}
const video = await VideoModel.load(file.getVideo().id)
const video = await VideoModel.loadWithBlacklist(file.getVideo().id)
return {
file,
@ -151,7 +150,7 @@ async function isWebVideoAllowed (req: express.Request, res: express.Response) {
async function isHLSAllowed (req: express.Request, res: express.Response, videoUUID: string) {
const filename = basename(req.path)
const video = await VideoModel.loadWithFiles(videoUUID)
const video = await VideoModel.loadAndPopulateAccountAndFiles(videoUUID)
if (!video) {
logger.debug('Unknown static file %s to serve', req.originalUrl, { videoUUID })

View file

@ -17,6 +17,7 @@ import {
isValidVideoIdParam,
isValidVideoPasswordHeader
} from '../shared/index.js'
import { canVideoBeFederated } from '@server/lib/activitypub/videos/federate.js'
const listVideoCommentsValidator = [
query('isLocal')
@ -132,8 +133,11 @@ const videoCommentGetValidator = [
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
if (areValidationErrors(req, res)) return
if (!await doesVideoExist(req.params.videoId, res, 'id')) return
if (!await doesVideoCommentExist(req.params.commentId, res.locals.videoId, res)) return
if (!await doesVideoExist(req.params.videoId, res, 'only-video-and-blacklist')) return
if (!canVideoBeFederated(res.locals.onlyVideo)) return res.sendStatus(HttpStatusCode.NOT_FOUND_404)
if (!await doesVideoCommentExist(req.params.commentId, res.locals.onlyVideo, res)) return
return next()
}

View file

@ -1,11 +1,12 @@
import { HttpStatusCode } from '@peertube/peertube-models'
import { canVideoBeFederated } from '@server/lib/activitypub/videos/federate.js'
import express from 'express'
import { param } from 'express-validator'
import { HttpStatusCode } from '@peertube/peertube-models'
import { isIdValid } from '../../../helpers/custom-validators/misc.js'
import { VideoShareModel } from '../../../models/video/video-share.js'
import { areValidationErrors, doesVideoExist, isValidVideoIdParam } from '../shared/index.js'
const videosShareValidator = [
export const videosShareValidator = [
isValidVideoIdParam('id'),
param('actorId')
@ -16,20 +17,12 @@ const videosShareValidator = [
if (!await doesVideoExist(req.params.id, res)) return
const video = res.locals.videoAll
if (!canVideoBeFederated(video)) res.sendStatus(HttpStatusCode.NOT_FOUND_404)
const share = await VideoShareModel.load(req.params.actorId, video.id)
if (!share) {
return res.status(HttpStatusCode.NOT_FOUND_404)
.end()
}
if (!share) return res.sendStatus(HttpStatusCode.NOT_FOUND_404)
res.locals.videoShare = share
return next()
}
]
// ---------------------------------------------------------------------------
export {
videosShareValidator
}

View file

@ -1392,6 +1392,12 @@ export class VideoModel extends SequelizeModel<VideoModel> {
return queryBuilder.queryVideo({ id, transaction, type: 'thumbnails-blacklist' })
}
static loadAndPopulateAccountAndFiles (id: number | string, transaction?: Transaction): Promise<MVideoAccountLightBlacklistAllFiles> {
const queryBuilder = new VideoModelGetQueryBuilder(VideoModel.sequelize)
return queryBuilder.queryVideo({ id, transaction, type: 'account-blacklist-files' })
}
static loadImmutableAttributes (id: number | string, t?: Transaction): Promise<MVideoImmutable> {
const fun = () => {
const query = {

View file

@ -20,7 +20,8 @@ import {
MVideoLiveFormattable,
MVideoPassword,
MVideoPlaylistFull,
MVideoPlaylistFullSummary
MVideoPlaylistFullSummary,
MVideoThumbnailBlacklist
} from '@server/types/models/index.js'
import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token.js'
import { MPlugin, MServer, MServerBlocklist } from '@server/types/models/server.js'
@ -44,8 +45,7 @@ import {
MVideoCaptionVideo,
MVideoFullLight,
MVideoRedundancyVideo,
MVideoShareActor,
MVideoThumbnail
MVideoShareActor
} from './models/index.js'
import { MRunner, MRunnerJobRunner, MRunnerRegistrationToken } from './models/runners/index.js'
import { MVideoSource } from './models/video/video-source.js'
@ -135,7 +135,7 @@ declare module 'express' {
videoAPI?: MVideoFormattableDetails
videoAll?: MVideoFullLight
onlyImmutableVideo?: MVideoImmutable
onlyVideo?: MVideoThumbnail
onlyVideo?: MVideoThumbnailBlacklist
videoId?: MVideoId
videoLive?: MVideoLiveFormattable