From 6fb6b5f1766a1f37a61b9faaa40209bab995bf30 Mon Sep 17 00:00:00 2001 From: Cody Robibero Date: Sun, 14 Apr 2024 08:18:36 -0600 Subject: Validate item access (#11171) --- Jellyfin.Api/Controllers/VideosController.cs | 31 +++++++++++++++------------- 1 file changed, 17 insertions(+), 14 deletions(-) (limited to 'Jellyfin.Api/Controllers/VideosController.cs') diff --git a/Jellyfin.Api/Controllers/VideosController.cs b/Jellyfin.Api/Controllers/VideosController.cs index 380120032..a9e1d4484 100644 --- a/Jellyfin.Api/Controllers/VideosController.cs +++ b/Jellyfin.Api/Controllers/VideosController.cs @@ -7,7 +7,6 @@ using System.Net.Http; using System.Threading; using System.Threading.Tasks; using Jellyfin.Api.Attributes; -using Jellyfin.Api.Constants; using Jellyfin.Api.Extensions; using Jellyfin.Api.Helpers; using Jellyfin.Api.ModelBinders; @@ -105,7 +104,11 @@ public class VideosController : BaseJellyfinApiController ? (userId.IsNullOrEmpty() ? _libraryManager.RootFolder : _libraryManager.GetUserRootFolder()) - : _libraryManager.GetItemById(itemId); + : _libraryManager.GetItemById(itemId, user); + if (item is null) + { + return NotFound(); + } var dtoOptions = new DtoOptions(); dtoOptions = dtoOptions.AddClientFields(User); @@ -139,24 +142,23 @@ public class VideosController : BaseJellyfinApiController [ProducesResponseType(StatusCodes.Status404NotFound)] public async Task DeleteAlternateSources([FromRoute, Required] Guid itemId) { - var video = (Video)_libraryManager.GetItemById(itemId); - - if (video is null) + var item = _libraryManager.GetItemById