From faa036aa7b696fd5091e52fd2bed6ed67ca63481 Mon Sep 17 00:00:00 2001
From: ArabCoders <admin@arabcoders.org>
Date: Mon, 13 Nov 2023 15:55:12 +0300
Subject: [PATCH] Added access validation to view item user data.

---
 Jellyfin.Api/Controllers/ItemsController.cs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Jellyfin.Api/Controllers/ItemsController.cs b/Jellyfin.Api/Controllers/ItemsController.cs
index 2a346be685..dd54e6ca78 100644
--- a/Jellyfin.Api/Controllers/ItemsController.cs
+++ b/Jellyfin.Api/Controllers/ItemsController.cs
@@ -902,6 +902,11 @@ public class ItemsController : BaseJellyfinApiController
         [FromRoute, Required] Guid userId,
         [FromRoute, Required] Guid itemId)
     {
+        if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
+        {
+            return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to view this item user data.");
+        }
+
         var user = _userManager.GetUserById(userId) ?? throw new ResourceNotFoundException();
         var item = _libraryManager.GetItemById(itemId);