Forum Discussion

phoneboy's avatar
phoneboy
Director
5 years ago

How do I determine user who created the video I am viewing?

The default video gallery is exceptionally insecure in that, if anyone knows the URL to a given video or knows how to view the site-wide video gallery, they can access the content, even if permissions say they should not be able to (e.g. the video is posted in a semi-private space).

I got around this by creating a custom component for the video gallery page that will not render the video gallery page unless the user is an admin or moderator. This allows videos to appear on the site, but blocks deep gallery links, e.g. https://community.checkpoint.com/t5/video/gallerypage/video-id/9zbXFzaTE65HoF1CxB07jiBo89kOizUp

The ultimate goal is to allow the person who posted the video to access the gallery page for that specific video in addition to admins and moderators.

It appears the same component is used for rendering a single video or a gallery of videos. How can I programmatically determine:

  • Whether I'm actually viewing a video versus the gallery
  • Who posted the video I'm current viewing

I don't see any documentation that covers these two items.

  • phoneboy's avatar
    phoneboy
    Director
    5 years ago

    It looks like I can do something like this to determine the video-id:

    <#assign videoId = webuisupport.path.rawParameters.name.get("video-id","")/>

    I figure, with the video-id, I can query the API and find out who owns the video. It seems not possible according to the reference in video type:  https://devdocportal.lithium.com/t5/Community-API-v2-Reference/bd-p/restv2docs?section=commv2&collection=videos

    If I try a LIQL query like:

    SELECT owner from videos WHERE id=9zbXFzaTE65HoF1CxB07jiBo89kOizUp 

    I get an error.
    It seems I can only query for videos a particular user uploaded or videos associated with a specific message.

    Is there really no way to do what I'm after here?