Check element belongs to the playlist

packages/tests/src/api/check-params/video-playlists.ts

@@ -30,8 +30,13 @@ describe('Test video playlists API validator', function () {
 
   let playlist: VideoPlaylistCreateResult
   let userPlaylist: VideoPlaylistCreateResult
+
   let privatePlaylistUUID: string
+  let privatePlaylistElementId: number
+
   let anotherChannelPlaylistUUID: string
+  let anotherChannelPlaylistElementId: number
+
   let privateForEditorPlaylistUUID: string
 
   let watchLaterPlaylistId: number
@@ -93,6 +98,9 @@ describe('Test video playlists API validator', function () {
         }
       })
       anotherChannelPlaylistUUID = created.uuid
+
+      const { id } = await command.addElement({ playlistId: created.shortUUID, attributes: { videoId } })
+      anotherChannelPlaylistElementId = id
     }
 
     {
@@ -103,6 +111,9 @@ describe('Test video playlists API validator', function () {
         }
       })
       privatePlaylistUUID = created.uuid
+
+      const { id } = await command.addElement({ playlistId: created.shortUUID, attributes: { videoId } })
+      privatePlaylistElementId = id
     }
 
     {
@@ -548,9 +559,33 @@ describe('Test video playlists API validator', function () {
     })
 
     it('Should fail for an editor with elements of a private or another channel playlist', async function () {
-      for (const playlistId of [ privatePlaylistUUID, anotherChannelPlaylistUUID ]) {
-        await command.updateElement(getBase({}, { playlistId, expectedStatus: HttpStatusCode.FORBIDDEN_403, token: editorToken }))
+      await command.updateElement(getBase(
+        {},
+        {
+          playlistId: privatePlaylistUUID,
+          elementId: privatePlaylistElementId,
+          expectedStatus: HttpStatusCode.FORBIDDEN_403,
+          token: editorToken
         }
+      ))
+
+      await command.updateElement(
+        getBase(
+          {},
+          {
+            playlistId: anotherChannelPlaylistUUID,
+            elementId: anotherChannelPlaylistElementId,
+            expectedStatus: HttpStatusCode.FORBIDDEN_403,
+            token: editorToken
+          }
+        )
+      )
+    })
+
+    it('Should fail if the element id does not belong to the playlist', async function () {
+      const params = getBase({}, { elementId: anotherChannelPlaylistElementId, expectedStatus: HttpStatusCode.NOT_FOUND_404 })
+
+      await command.updateElement(params)
     })
 
     it('Should fail with an unknown or incorrect playlist id', async function () {

server/core/middlewares/validators/videos/video-playlists.ts

@@ -288,8 +288,7 @@ export const videoPlaylistsUpdateOrRemoveVideoValidator = [
   isValidPlaylistIdParam('playlistId'),
 
   param('playlistElementId')
-    .customSanitizer(toCompleteUUID)
-    .custom(isIdValid).withMessage('Should have an element id/uuid/short uuid'),
+    .custom(isIdValid).withMessage('Should have an element id'),
 
   body('startTimestamp')
     .optional()
@@ -305,16 +304,6 @@ export const videoPlaylistsUpdateOrRemoveVideoValidator = [
 
     const videoPlaylist = getPlaylist(res)
 
-    const videoPlaylistElement = await VideoPlaylistElementModel.loadById(req.params.playlistElementId)
-    if (!videoPlaylistElement) {
-      res.fail({
-        status: HttpStatusCode.NOT_FOUND_404,
-        message: req.t('Video playlist element not found')
-      })
-      return
-    }
-    res.locals.videoPlaylistElement = videoPlaylistElement
-
     if (
       !await checkCanManagePlaylist({
         user: res.locals.oauth.token.User,
@@ -325,6 +314,20 @@ export const videoPlaylistsUpdateOrRemoveVideoValidator = [
       })
     ) return
 
+    const videoPlaylistElement = await VideoPlaylistElementModel.loadByPlaylistAndElement({
+      videoPlaylistId: videoPlaylist.id,
+      elementId: req.params.playlistElementId
+    })
+
+    if (!videoPlaylistElement) {
+      res.fail({
+        status: HttpStatusCode.NOT_FOUND_404,
+        message: req.t('Video playlist element not found')
+      })
+      return
+    }
+    res.locals.videoPlaylistElement = videoPlaylistElement
+
     return next()
   }
 ]

server/core/models/video/video-playlist-element.ts

@@ -205,8 +205,16 @@ export class VideoPlaylistElementModel extends SequelizeModel<VideoPlaylistEleme
     return VideoPlaylistElementModel.findOne(query)
   }
 
-  static loadById (playlistElementId: number | string): Promise<MVideoPlaylistElement> {
-    return VideoPlaylistElementModel.findByPk(playlistElementId)
+  static loadByPlaylistAndElement (options: {
+    videoPlaylistId: number
+    elementId: number | string
+  }): Promise<MVideoPlaylistElement> {
+    return VideoPlaylistElementModel.findOne({
+      where: {
+        id: options.elementId,
+        videoPlaylistId: options.videoPlaylistId
+      }
+    })
   }
 
   static loadByPlaylistAndElementIdForAP (