Feature/password protected videos

[wickloww]

Description

Enable a password protection privacy for videos.

Related issues

Fixes #620

Has this been tested?

• 👍 yes, I added tests to the test suite
• 💭 no, because this PR is a draft and still needs work
• 🙅 no, because this PR does not update server code
• 🙋 no, because I need help

Screenshots

[JohnXLivingston]

Hello. Seems to be a great feature!

I'm the developer of the livechat plugin. I don't have the time to test your feature in the coming days, but it want to be sure that the livechat plugin is compatible. In other words: that the chat won't be displayed before you enter the password, and that the chat url can't be guessed (so that a bad actor could join the chat, even if he did not know the password).

Would it be possible for you to test the first point? That the chat does not show up before you entered the password?

For the second point, currently the chat url contains the video UUID. So I guess it is an issue (i suppose that you can see the real video url before entering the password?). How can a plugin backend know if the current user has access to such a video? Is there any hook I can test? Any cookie? Or maybe a front-end hook so that the plugin can obtain the typed password, and send it to the backend (where a backend plugin hook can check the password?)

[wickloww]

Hi, I've just tested my feature with your plugin, it seems to work fine together.

That the chat does not show up before you entered the password?

It doesn't seem to be displayed before. The UUID of the video is not sensitive data, because the password protection of the video works like a private video, but instead of using your login details, you use a password.

[JohnXLivingston]

Hi, I've just tested my feature with your plugin, it seems to work fine together.

Great!

The UUID of the video is not sensitive data, because the password protection of the video works like a private video, but instead of using your login details, you use a password.

What i meant was, if the video is https://videos.john-livingston.fr/videos/watch/c5d20adf-1088-4d40-bbfc-1abb42d20b05, then an attacker could guess the chat url: https://videos.john-livingston.fr/plugins/livechat/router/webchat/room/c5d20adf-1088-4d40-bbfc-1abb42d20b05. I need a way to prevent bad actors to open the chat url if he don't have the password.