From f9f263a481c696719532fe3757fb7015fb0f9ff0 Mon Sep 17 00:00:00 2001
From: Shadowghost <Ghost_of_Stone@web.de>
Date: Sat, 4 May 2024 12:34:54 +0200
Subject: [PATCH] Fix playlist access checks

---
 .../Playlists/PlaylistManager.cs              | 30 ++++++++++++++-----
 .../Controllers/PlaylistsController.cs        |  5 ++++
 .../Playlists/IPlaylistManager.cs             |  2 +-
 3 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/Emby.Server.Implementations/Playlists/PlaylistManager.cs b/Emby.Server.Implementations/Playlists/PlaylistManager.cs
index 6007591b2d..8a35b96b39 100644
--- a/Emby.Server.Implementations/Playlists/PlaylistManager.cs
+++ b/Emby.Server.Implementations/Playlists/PlaylistManager.cs
@@ -22,7 +22,6 @@ using MediaBrowser.Controller.Providers;
 using MediaBrowser.Model.Entities;
 using MediaBrowser.Model.IO;
 using MediaBrowser.Model.Playlists;
-using Microsoft.EntityFrameworkCore.Diagnostics;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging;
 using PlaylistsNET.Content;
@@ -68,8 +67,14 @@ namespace Emby.Server.Implementations.Playlists
         public IEnumerable<Playlist> GetPlaylists(Guid userId)
         {
             var user = _userManager.GetUserById(userId);
-
-            return GetPlaylistsFolder(userId).GetChildren(user, true).OfType<Playlist>();
+            return _libraryManager.GetItemList(new InternalItemsQuery
+            {
+                IncludeItemTypes = [BaseItemKind.Playlist],
+                Recursive = true,
+                DtoOptions = new DtoOptions(false)
+            })
+            .Cast<Playlist>()
+            .Where(p => p.IsVisible(user));
         }
 
         public async Task<PlaylistCreationResult> CreatePlaylist(PlaylistCreationRequest request)
@@ -162,6 +167,13 @@ namespace Emby.Server.Implementations.Playlists
             }
         }
 
+        private List<Playlist> GetUserPlaylists(Guid userId)
+        {
+            var user = _userManager.GetUserById(userId);
+
+            return GetPlaylistsFolder(userId).GetChildren(user, true).OfType<Playlist>().ToList();
+        }
+
         private static string GetTargetPath(string path)
         {
             while (Directory.Exists(path))
@@ -227,7 +239,7 @@ namespace Emby.Server.Implementations.Playlists
             }
 
             // Update the playlist in the repository
-            playlist.LinkedChildren = [..playlist.LinkedChildren, ..childrenToAdd];
+            playlist.LinkedChildren = [.. playlist.LinkedChildren, .. childrenToAdd];
 
             await UpdatePlaylistInternal(playlist).ConfigureAwait(false);
 
@@ -501,11 +513,13 @@ namespace Emby.Server.Implementations.Playlists
             return relativePath;
         }
 
+        /// <inheritdoc />
         public Folder GetPlaylistsFolder()
         {
             return GetPlaylistsFolder(Guid.Empty);
         }
 
+        /// <inheritdoc />
         public Folder GetPlaylistsFolder(Guid userId)
         {
             const string TypeName = "PlaylistsFolder";
@@ -517,7 +531,7 @@ namespace Emby.Server.Implementations.Playlists
         /// <inheritdoc />
         public async Task RemovePlaylistsAsync(Guid userId)
         {
-            var playlists = GetPlaylists(userId);
+            var playlists = GetUserPlaylists(userId);
             foreach (var playlist in playlists)
             {
                 // Update owner if shared
@@ -555,9 +569,9 @@ namespace Emby.Server.Implementations.Playlists
 
                 var user = _userManager.GetUserById(request.UserId);
                 await AddToPlaylistInternal(request.Id, request.Ids, user, new DtoOptions(false)
-                    {
-                        EnableImages = true
-                    }).ConfigureAwait(false);
+                {
+                    EnableImages = true
+                }).ConfigureAwait(false);
 
                 playlist = GetPlaylistForUser(request.Id, request.UserId);
             }
diff --git a/Jellyfin.Api/Controllers/PlaylistsController.cs b/Jellyfin.Api/Controllers/PlaylistsController.cs
index abf94a32fa..44149ed6f7 100644
--- a/Jellyfin.Api/Controllers/PlaylistsController.cs
+++ b/Jellyfin.Api/Controllers/PlaylistsController.cs
@@ -221,6 +221,11 @@ public class PlaylistsController : BaseJellyfinApiController
             return userPermission;
         }
 
+        if (playlist.OwnerUserId.Equals(callingUserId))
+        {
+            return new PlaylistUserPermissions(callingUserId, true);
+        }
+
         return NotFound("User permissions not found");
     }
 
diff --git a/MediaBrowser.Controller/Playlists/IPlaylistManager.cs b/MediaBrowser.Controller/Playlists/IPlaylistManager.cs
index cbe4bd87f5..038cbd2d67 100644
--- a/MediaBrowser.Controller/Playlists/IPlaylistManager.cs
+++ b/MediaBrowser.Controller/Playlists/IPlaylistManager.cs
@@ -34,7 +34,7 @@ namespace MediaBrowser.Controller.Playlists
         Task UpdatePlaylist(PlaylistUpdateRequest request);
 
         /// <summary>
-        /// Gets the playlists.
+        /// Gets all playlists a user has access to.
         /// </summary>
         /// <param name="userId">The user identifier.</param>
         /// <returns>IEnumerable&lt;Playlist&gt;.</returns>