yetangitu/Peertube
1
0
Fork 0
mirror of https://github.com/Chocobozzz/PeerTube.git synced 2025-10-05 19:42:24 +02:00
Code Issues Releases Wiki Activity

Fix HLS private static path

Browse source
This commit is contained in:
Chocobozzz 2025-04-08 07:16:54 +02:00
parent 473cd4f7ef
commit 94deeb0a8f
No known key found for this signature in database
GPG key ID: 583A612D890159BE
3 changed files with 47 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

41
server/core/middlewares/validators/static.ts
View file

@ -1,6 +1,7 @@
import { HttpStatusCode } from '@peertube/peertube-models'
import {
exists,
isSafeFilename,
isSafePeerTubeFilenameWithoutExtension,
isUUIDValid,
toBooleanOrNull
@ -28,7 +29,7 @@ const staticFileTokenBypass = new LRUCache<string, LRUValue>({
ttl: LRU_CACHE.STATIC_VIDEO_FILES_RIGHTS_CHECK.TTL
})
const ensureCanAccessVideoPrivateWebVideoFiles = [
export const ensureCanAccessVideoPrivateWebVideoFiles = [
query('videoFileToken').optional().custom(exists),
isValidVideoPasswordHeader(),
@ -67,23 +68,44 @@ const ensureCanAccessVideoPrivateWebVideoFiles = [
}
]
const ensureCanAccessPrivateVideoHLSFiles = [
export const privateM3U8PlaylistValidator = [
param('videoUUID')
.custom(isUUIDValid),
param('playlistNameWithoutExtension')
.optional()
.custom(v => isSafePeerTubeFilenameWithoutExtension(v)),
query('videoFileToken')
.optional()
.custom(exists),
query('reinjectVideoFileToken')
.optional()
.customSanitizer(toBooleanOrNull)
.isBoolean().withMessage('Should be a valid reinjectVideoFileToken boolean'),
(req: express.Request, res: express.Response, next: express.NextFunction) => {
if (areValidationErrors(req, res)) return
return next()
}
]
export const privateHLSFileValidator = [
param('videoUUID')
.custom(isUUIDValid),
param('filename')
.custom(v => isSafeFilename(v)),
(req: express.Request, res: express.Response, next: express.NextFunction) => {
if (areValidationErrors(req, res)) return
return next()
}
]
export const ensureCanAccessPrivateVideoHLSFiles = [
query('videoFileToken')
.optional()
.custom(exists),
isValidVideoPasswordHeader(),
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
@ -124,11 +146,6 @@ const ensureCanAccessPrivateVideoHLSFiles = [
}
]
export {
ensureCanAccessPrivateVideoHLSFiles,
ensureCanAccessVideoPrivateWebVideoFiles
}
// ---------------------------------------------------------------------------
async function isWebVideoAllowed (req: express.Request, res: express.Response) {