Mirrored_Repos/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2026-06-29 10:04:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: security issue playlist deletion cross user

Browse Source 
fixes #5777
This commit is contained in:
Emilien
2026-06-28 11:41:48 +02:00
parent efb9269e58
commit 7b9a8e3456
3 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/invidious/database/playlists.cr
View File

@@ -194,13 +194,13 @@ module Invidious::Database::PlaylistVideos
PG_DB.exec(request, args: video_array) PG_DB.exec(request, args: video_array)
end end
def delete(index) def delete(index, plid : String)
request = <<-SQL request = <<-SQL
DELETE FROM playlist_videos * DELETE FROM playlist_videos *
WHERE index = $1 WHERE index = $1 AND plid = $2
SQL SQL
PG_DB.exec(request, index) PG_DB.exec(request, index, plid)
end end
def delete_by_playlist(plid : String) def delete_by_playlist(plid : String)

2
src/invidious/routes/api/v1/authenticated.cr
View File

@@ -364,7 +364,7 @@ module Invidious::Routes::API::V1::Authenticated
return error_json(404, "Playlist does not contain index") return error_json(404, "Playlist does not contain index")
end end
Invidious::Database::PlaylistVideos.delete(index) Invidious::Database::PlaylistVideos.delete(index, plid)
Invidious::Database::Playlists.update_video_removed(plid, index) Invidious::Database::Playlists.update_video_removed(plid, index)
env.response.status_code = 204 env.response.status_code = 204

8
src/invidious/routes/playlists.cr
View File

@@ -357,8 +357,12 @@ module Invidious::Routes::Playlists
Invidious::Database::PlaylistVideos.insert(playlist_video) Invidious::Database::PlaylistVideos.insert(playlist_video)
Invidious::Database::Playlists.update_video_added(playlist_id, playlist_video.index) Invidious::Database::Playlists.update_video_added(playlist_id, playlist_video.index)
when "remove_video" when "remove_video"
index = env.params.query["set_video_id"] index = env.params.query["set_video_id"].to_i64?
Invidious::Database::PlaylistVideos.delete(index) if index.nil? || !playlist.index.includes? index
return error_json(404, "Playlist does not contain index")
end
Invidious::Database::PlaylistVideos.delete(index, playlist_id)
Invidious::Database::Playlists.update_video_removed(playlist_id, index) Invidious::Database::Playlists.update_video_removed(playlist_id, index)
when "move_video_before" when "move_video_before"
# TODO: Playlist stub # TODO: Playlist stub