VeritableValor/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2026-09-26 11:35:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

Use validate_video_id on more places

Browse Source
This commit is contained in:
Fijxu 2026-09-14 18:14:45 -03:00
parent 73c3163d8f
commit fc4be8fbac
No known key found for this signature in database
GPG Key ID: 32C1DDF333EDA6A4
2 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/invidious/routes/api/v1/authenticated.cr
View File

@ -98,12 +98,12 @@ module Invidious::Routes::API::V1::Authenticated
return error_json(409, "Watch history is disabled in preferences.")
end
id = env.params.url["id"]
if !id.match(/^[a-zA-Z0-9_-]{11}$/)
return error_json(400, "Invalid video id.")
video_id = env.params.url["id"]
unless video_id && validate_video_id(video_id)
return error_json(400, InvalidVideoID.new(video_id))
end
Invidious::Database::Users.mark_unwatched(user, id)
Invidious::Database::Users.mark_unwatched(user, video_id)
env.response.status_code = 204
end

18
src/invidious/routes/api/v1/videos.cr
View File

@ -257,11 +257,11 @@ module Invidious::Routes::API::V1::Videos
def self.annotations(env)
env.response.content_type = "text/xml"
id = env.params.url["id"]
video_id = env.params.url["id"]
source = env.params.query["source"]?
source ||= "archive"
if !id.match(/[a-zA-Z0-9_-]{11}/)
unless video_id && validate_video_id(video_id)
haltf env, 400
end
@ -269,21 +269,21 @@ module Invidious::Routes::API::V1::Videos
case source
when "archive"
if CONFIG.cache_annotations && (cached_annotation = Invidious::Database::Annotations.select(id))
if CONFIG.cache_annotations && (cached_annotation = Invidious::Database::Annotations.select(video_id))
annotations = cached_annotation.annotations
else
index = CHARS_SAFE.index!(id[0]).to_s.rjust(2, '0')
index = CHARS_SAFE.index!(video_id[0]).to_s.rjust(2, '0')
# IA doesn't handle leading hyphens,
# so we use https://archive.org/details/youtubeannotations_64
if index == "62"
index = "64"
id = id.sub(/^-/, 'A')
video_id = video_id.sub(/^-/, 'A')
end
file = URI.encode_www_form("#{id[0, 3]}/#{id}.xml")
file = URI.encode_www_form("#{video_id[0, 3]}/#{video_id}.xml")
location = make_client(INTERNET_ARCHIVE_URL, &.get("/download/youtubeannotations_#{index}/#{id[0, 2]}.tar/#{file}"))
location = make_client(INTERNET_ARCHIVE_URL, &.get("/download/youtubeannotations_#{index}/#{video_id[0, 2]}.tar/#{file}"))
if !location.headers["Location"]?
env.response.status_code = location.status_code
@ -301,10 +301,10 @@ module Invidious::Routes::API::V1::Videos
annotations = response.body
Helpers.cache_annotation(id, annotations)
Helpers.cache_annotation(video_id, annotations)
end
else # "youtube"
response = YT_POOL.client &.get("/annotations_invideo?video_id=#{id}")
response = YT_POOL.client &.get("/annotations_invideo?video_id=#{video_id}")
if response.status_code != 200
haltf env, response.status_code