Validate item access (#11171)

This commit is contained in:
Cody Robibero
2024-04-14 08:18:36 -06:00
committed by GitHub
parent 9a4db80085
commit 6fb6b5f176
28 changed files with 422 additions and 289 deletions

View File

@@ -234,7 +234,7 @@ public class TvShowsController : BaseJellyfinApiController
if (seasonId.HasValue) // Season id was supplied. Get episodes by season id.
{
var item = _libraryManager.GetItemById(seasonId.Value);
var item = _libraryManager.GetItemById<BaseItem>(seasonId.Value);
if (item is not Season seasonItem)
{
return NotFound("No season exists with Id " + seasonId);
@@ -244,7 +244,8 @@ public class TvShowsController : BaseJellyfinApiController
}
else if (season.HasValue) // Season number was supplied. Get episodes by season number
{
if (_libraryManager.GetItemById(seriesId) is not Series series)
var series = _libraryManager.GetItemById<Series>(seriesId);
if (series is null)
{
return NotFound("Series not found");
}
@@ -259,7 +260,7 @@ public class TvShowsController : BaseJellyfinApiController
}
else // No season number or season id was supplied. Returning all episodes.
{
if (_libraryManager.GetItemById(seriesId) is not Series series)
if (_libraryManager.GetItemById<BaseItem>(seriesId) is not Series series)
{
return NotFound("Series not found");
}
@@ -342,13 +343,13 @@ public class TvShowsController : BaseJellyfinApiController
var user = userId.IsNullOrEmpty()
? null
: _userManager.GetUserById(userId.Value);
if (_libraryManager.GetItemById(seriesId) is not Series series)
var item = _libraryManager.GetItemById<Series>(seriesId, user);
if (item is null)
{
return NotFound("Series not found");
return NotFound();
}
var seasons = series.GetItemList(new InternalItemsQuery(user)
var seasons = item.GetItemList(new InternalItemsQuery(user)
{
IsMissing = isMissing,
IsSpecialSeason = isSpecialSeason,