hdf

src/inc/routeinc/f0cklib.mjs

@@ -954,15 +954,6 @@ export default {
       session.admin || session.is_moderator
     );
 
-    // If request was by sequential numeric ID (/123) and item visibility > 0 (unlisted/private):
-    // Block numeric enumeration unless viewer is owner/admin
-    if (isNumeric && actitem.visibility > 0 && !isOwnerOrAdmin) {
-      return {
-        success: false,
-        message: "404 - upload not found"
-      };
-    }
-
     // If item is Private (visibility === 2):
     // Direct link only allowed for owner/admin
     if (actitem.visibility === 2 && !isOwnerOrAdmin) {
@@ -973,6 +964,15 @@ export default {
       };
     }
 
+    // If request was by sequential numeric ID (/123) and item visibility > 0 (unlisted):
+    // Block numeric enumeration unless viewer is owner/admin
+    if (isNumeric && actitem.visibility > 0 && !isOwnerOrAdmin) {
+      return {
+        success: false,
+        message: "404 - upload not found"
+      };
+    }
+
     if (user_id) {
        db`
         insert into user_video_views (user_id, video_id, view_count, last_viewed)