Don't show private VoDs on the course page to non course admins

TUM-Dev · Mar 24, 2024 · ed5f5d1 · ed5f5d1
1 parent fa96c9d
commit ed5f5d1
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/api/courses.go b/api/courses.go
@@ -359,7 +359,14 @@ func (r coursesRoutes) getCourseBySlug(c *gin.Context) {
 		c.AbortWithStatus(http.StatusUnauthorized)
 	}
 
-	streams := course.Streams
+	user := tumLiveContext.User
+	var streams []model.Stream
+	for _, stream := range course.Streams {
+		if !stream.Private || (user != nil && user.IsAdminOfCourse(course)) {
+			streams = append(streams, stream)
+		}
+	}
+
 	streamsDTO := make([]model.StreamDTO, len(streams))
 	for i, s := range streams {
 		err := tools.SetSignedPlaylists(&s, &model.User{