Merge pull request #2922 from SamantazFox/download-widget-fix

Download widget fix

src/invidious/routes/api/v1/videos.cr

@@ -23,7 +23,11 @@ module Invidious::Routes::API::V1::Videos
     env.response.content_type = "application/json"
 
     id = env.params.url["id"]
-    region = env.params.query["region"]?
+    region = env.params.query["region"]? || env.params.body["region"]?
+
+    if id.nil? || id.size != 11 || !id.matches?(/^[\w-]+$/)
+      return error_json(400, "Invalid video ID")
+    end
 
     # See https://github.com/ytdl-org/youtube-dl/blob/6ab30ff50bf6bd0585927cb73c7421bef184f87a/youtube_dl/extractor/youtube.py#L1354
     # It is possible to use `/api/timedtext?type=list&v=#{id}` and

src/invidious/routes/video_playback.cr

@@ -164,7 +164,9 @@ module Invidious::Routes::VideoPlayback
 
               if title = query_params["title"]?
                 # https://blog.fastmail.com/2011/06/24/download-non-english-filenames/
-                env.response.headers["Content-Disposition"] = "attachment; filename=\"#{URI.encode_www_form(title)}\"; filename*=UTF-8''#{URI.encode_www_form(title)}"
+                filename = URI.encode_www_form(title, space_to_plus: false)
+                header = "attachment; filename=\"#{filename}\"; filename*=UTF-8''#{filename}"
+                env.response.headers["Content-Disposition"] = header
               end
 
               if !resp.headers.includes_word?("Transfer-Encoding", "chunked")
@@ -242,31 +244,25 @@ module Invidious::Routes::VideoPlayback
   # YouTube /videoplayback links expire after 6 hours,
   # so we have a mechanism here to redirect to the latest version
   def self.latest_version(env)
-    if env.params.query["download_widget"]?
-      download_widget = JSON.parse(env.params.query["download_widget"])
+    id = env.params.query["id"]?
+    itag = env.params.query["itag"]?.try &.to_i?
 
-      id = download_widget["id"].as_s
-      title = URI.decode_www_form(download_widget["title"].as_s)
-
-      if label = download_widget["label"]?
-        return env.redirect "/api/v1/captions/#{id}?label=#{label}&title=#{title}"
-      else
-        itag = download_widget["itag"].as_s.to_i
-        local = "true"
-      end
+    # Sanity checks
+    if id.nil? || id.size != 11 || !id.matches?(/^[\w-]+$/)
+      return error_template(400, "Invalid video ID")
     end
 
-    id ||= env.params.query["id"]?
-    itag ||= env.params.query["itag"]?.try &.to_i
+    if itag.nil? || itag <= 0 || itag >= 1000
+      return error_template(400, "Invalid itag")
+    end
 
     region = env.params.query["region"]?
+    local = (env.params.query["local"]? == "true")
 
-    local ||= env.params.query["local"]?
-    local ||= "false"
-    local = local == "true"
+    title = env.params.query["title"]?
 
-    if !id || !itag
-      haltf env, status_code: 400, response: "TESTING"
+    if title && CONFIG.disabled?("downloads")
+      return error_template(403, "Administrator has disabled this endpoint.")
     end
 
     video = get_video(id, region: region)
@@ -278,8 +274,10 @@ module Invidious::Routes::VideoPlayback
       haltf env, status_code: 404
     end
 
-    url = URI.parse(url).request_target.not_nil! if local
-    url = "#{url}&title=#{title}" if title
+    if local
+      url = URI.parse(url).request_target.not_nil!
+      url += "&title=#{URI.encode_www_form(title, space_to_plus: false)}" if title
+    end
 
     return env.redirect url
   end

src/invidious/routes/watch.cr

@@ -189,6 +189,14 @@ module Invidious::Routes::Watch
       return env.redirect url
     end
 
+    # Structure used for the download widget
+    video_assets = Invidious::Frontend::WatchPage::VideoAssets.new(
+      full_videos: fmt_stream,
+      video_streams: video_streams,
+      audio_streams: audio_streams,
+      captions: video.captions
+    )
+
     templated "watch"
   end
 
@@ -281,4 +289,49 @@ module Invidious::Routes::Watch
       return error_template(404, "The requested clip doesn't exist")
     end
   end
+
+  def self.download(env)
+    if CONFIG.disabled?("downloads")
+      return error_template(403, "Administrator has disabled this endpoint.")
+    end
+
+    title = env.params.body["title"]? || ""
+    video_id = env.params.body["id"]? || ""
+    selection = env.params.body["download_widget"]?
+
+    if title.empty? || video_id.empty? || selection.nil?
+      return error_template(400, "Missing form data")
+    end
+
+    download_widget = JSON.parse(selection)
+
+    extension = download_widget["ext"].as_s
+    filename = "#{video_id}-#{title}.#{extension}"
+
+    # Pass form parameters as URL parameters for the handlers of both
+    # /latest_version and /api/v1/captions. This avoids an un-necessary
+    # redirect and duplicated (and hazardous) sanity checks.
+    env.params.query["id"] = video_id
+    env.params.query["title"] = filename
+
+    # Delete the useless ones
+    env.params.body.delete("id")
+    env.params.body.delete("title")
+    env.params.body.delete("download_widget")
+
+    if label = download_widget["label"]?
+      # URL params specific to /api/v1/captions/:id
+      env.params.query["label"] = URI.encode_www_form(label.as_s, space_to_plus: false)
+
+      return Invidious::Routes::API::V1::Videos.captions(env)
+    elsif itag = download_widget["itag"]?.try &.as_i
+      # URL params specific to /latest_version
+      env.params.query["itag"] = itag.to_s
+      env.params.query["local"] = "true"
+
+      return Invidious::Routes::VideoPlayback.latest_version(env)
+    else
+      return error_template(400, "Invalid label or itag")
+    end
+  end
 end