Updated video playing/sharing logic to support sharing of playlists in multi user mode and when multi user mode is disabled

Fixed bug that caused normal archive to be used in multi-user mode

Updated login logic when username is not found or user file is missing

Fixed bug that prevented playlist sharing from working

Added ability to use timestamps when sharing videos

backend/app.js

@@ -1762,8 +1762,14 @@ const optionalJwt = function (req, res, next) {
         const uuid = using_body ? req.body.uuid : req.query.uuid;
         const uid = using_body ? req.body.uid : req.query.uid;
         const type = using_body ? req.body.type : req.query.type;
-        const is_shared = auth_api.getUserVideo(uuid, uid, type, true);
-        if (is_shared) return next();
+        const is_shared = !req.query.id ? auth_api.getUserVideo(uuid, uid, type, true) : auth_api.getUserPlaylist(uuid, req.query.id, null, true);
+        if (is_shared) {
+            req.can_watch = true;
+            return next();
+        } else {
+            res.sendStatus(401);
+            return;
+        }
     } else if (multiUserMode && !(req.path.includes('/api/auth/register') && !req.query.jwt)) { // registration should get passed through
         if (!req.query.jwt) {
             res.sendStatus(401);
@@ -1983,7 +1989,6 @@ app.post('/api/enableSharing', optionalJwt, function(req, res) {
     if (req.isAuthenticated()) {
         // if multi user mode, use this method instead
         success = auth_api.changeSharingMode(req.user.uid, uid, type, is_playlist, true);
-        console.log(success);
         res.send({success: success});
         return;
     }
@@ -2262,11 +2267,12 @@ app.post('/api/createPlaylist', optionalJwt, async (req, res) => {
 app.post('/api/getPlaylist', optionalJwt, async (req, res) => {
     let playlistID = req.body.playlistID;
     let type = req.body.type;
+    let uuid = req.body.uuid;
 
     let playlist = null;
 
     if (req.isAuthenticated()) {
-        playlist = auth_api.getUserPlaylist(req.user.uid, playlistID, type);
+        playlist = auth_api.getUserPlaylist(uuid ? uuid : req.user.uid, playlistID, type);
         type = playlist.type;
     } else {
         if (!type) {
@@ -2563,13 +2569,13 @@ app.get('/api/video/:id', optionalJwt, function(req , res){
     let optionalParams = url_api.parse(req.url,true).query;
     let id = decodeURIComponent(req.params.id);
     let file_path = videoFolderPath + id + '.mp4';
-    if (req.isAuthenticated()) {
+    if (req.isAuthenticated() || req.can_watch) {
         let usersFileFolder = config_api.getConfigItem('ytdl_users_base_path');
         if (optionalParams['subName']) {
             const isPlaylist = optionalParams['subPlaylist'];
             file_path = path.join(usersFileFolder, req.user.uid, 'subscriptions', (isPlaylist === 'true' ? 'playlists/' : 'channels/'),optionalParams['subName'], id + '.mp4')
         } else {
-            file_path = path.join(usersFileFolder, req.user.uid, 'video', id + '.mp4');
+            file_path = path.join(usersFileFolder, req.query.uuid ? req.query.uuid : req.user.uid, 'video', id + '.mp4');
         }
     } else if (optionalParams['subName']) {
         let basePath = config_api.getConfigItem('ytdl_subscriptions_base_path');

backend/authentication/auth.js

@@ -157,7 +157,7 @@ exports.passport.use(new LocalStrategy({
     passwordField: 'password'},
     function(username, password, done) {
         const user = users_db.get('users').find({name: username}).value();
-        if (!user) { console.log('user not found'); return done(null, false); }
+        if (!user) { logger.error(`User ${username} not found`); return done(null, false); }
         if (user) {
             return done(null, bcrypt.compareSync(password, user.passhash) ? user : false);
         }
@@ -346,7 +346,7 @@ exports.getUserPlaylists = function(user_uid, type) {
   return user['playlists'][type];
 }
 
-exports.getUserPlaylist = function(user_uid, playlistID, type) {
+exports.getUserPlaylist = function(user_uid, playlistID, type, requireSharing = false) {
   let playlist = null;
   if (!type) {
     playlist = users_db.get('users').find({uid: user_uid}).get(`playlists.audio`).find({id: playlistID}).value();
@@ -358,6 +358,10 @@ exports.getUserPlaylist = function(user_uid, playlistID, type) {
     }
   }
   if (!playlist) playlist = users_db.get('users').find({uid: user_uid}).get(`playlists.${type}`).find({id: playlistID}).value();
+
+  // prevent unauthorized users from accessing the file info
+  if (requireSharing && !playlist['sharingEnabled']) playlist = null;
+
   return playlist;
 }
 
@@ -434,7 +438,7 @@ exports.deleteUserFile = function(user_uid, file_uid, type, blacklistMode = fals
     success = true;
   } else {
     success = false;
-    console.log('file does not exist!');
+    logger.warn(`User file ${file_uid} does not exist!`);
   }
 
   return success;
@@ -444,7 +448,7 @@ exports.changeSharingMode = function(user_uid, file_uid, type, is_playlist, enab
   let success = false;
   const user_db_obj = users_db.get('users').find({uid: user_uid});
   if (user_db_obj.value()) {
-    const file_db_obj = is_playlist ? user_db_obj.get(`playlists.${type}`).find({uid: file_uid}) : user_db_obj.get(`files.${type}`).find({uid: file_uid});
+    const file_db_obj = is_playlist ? user_db_obj.get(`playlists.${type}`).find({id: file_uid}) : user_db_obj.get(`files.${type}`).find({uid: file_uid});
     if (file_db_obj.value()) {
       success = true;
       file_db_obj.assign({sharingEnabled: enabled}).write();

backend/subscriptions.js

@@ -49,7 +49,7 @@ async function subscribe(sub, user_uid = null) {
         else
             db.get('subscriptions').push(sub).write();
 
-        let success = await getSubscriptionInfo(sub);
+        let success = await getSubscriptionInfo(sub, user_uid);
         result_obj.success = success;
         result_obj.sub = sub;
         getVideosForSub(sub, user_uid);