diff options
| -rw-r--r-- | Jellyfin.Api/Controllers/SessionController.cs | 8 | ||||
| -rw-r--r-- | tests/Jellyfin.Server.Integration.Tests/Controllers/SessionControllerTests.cs | 2 |
2 files changed, 8 insertions, 2 deletions
diff --git a/Jellyfin.Api/Controllers/SessionController.cs b/Jellyfin.Api/Controllers/SessionController.cs index 52b58b8f1..60de66ab0 100644 --- a/Jellyfin.Api/Controllers/SessionController.cs +++ b/Jellyfin.Api/Controllers/SessionController.cs @@ -84,7 +84,8 @@ public class SessionController : BaseJellyfinApiController if (!user.HasPermission(PermissionKind.EnableRemoteControlOfOtherUsers)) { - result = result.Where(i => i.UserId.IsEmpty() || i.ContainsUser(controllableByUserId.Value)); + // User cannot control other user's sessions, validate user id. + result = result.Where(i => i.UserId.IsEmpty() || i.ContainsUser(RequestHelpers.GetUserId(User, controllableByUserId))); } if (!user.HasPermission(PermissionKind.EnableSharedDeviceControl)) @@ -105,6 +106,11 @@ public class SessionController : BaseJellyfinApiController return true; }); } + else if (!User.IsInRole(UserRoles.Administrator)) + { + // Request isn't from administrator, limit to "own" sessions. + result = result.Where(i => i.UserId.IsEmpty() || i.ContainsUser(User.GetUserId())); + } if (activeWithinSeconds.HasValue && activeWithinSeconds.Value > 0) { diff --git a/tests/Jellyfin.Server.Integration.Tests/Controllers/SessionControllerTests.cs b/tests/Jellyfin.Server.Integration.Tests/Controllers/SessionControllerTests.cs index b9def13f8..ab68884f9 100644 --- a/tests/Jellyfin.Server.Integration.Tests/Controllers/SessionControllerTests.cs +++ b/tests/Jellyfin.Server.Integration.Tests/Controllers/SessionControllerTests.cs @@ -21,7 +21,7 @@ public class SessionControllerTests : IClassFixture<JellyfinApplicationFactory> var client = _factory.CreateClient(); client.DefaultRequestHeaders.AddAuthHeader(_accessToken ??= await AuthHelper.CompleteStartupAsync(client)); - using var response = await client.GetAsync($"Session/Sessions?userId={Guid.NewGuid()}"); + using var response = await client.GetAsync($"Sessions?controllableByUserId={Guid.NewGuid()}"); Assert.Equal(HttpStatusCode.NotFound, response.StatusCode); } } |