upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-10 17:23:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 57

fix(files): check that node is in user root folder for view-in-folder action

Browse source 
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
This commit is contained in:
skjnldsv 2024-11-08 09:23:12 +01:00
parent 4a2091ecb7
commit 9571e34182
2 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
apps/files/src/actions/viewInFolderAction.spec.ts
View file

@ -109,6 +109,18 @@ describe('View in folder action enabled tests', () => {
expect(action.enabled).toBeDefined()
expect(action.enabled!([folder], view)).toBe(false)
})
test('Disabled for files outside the user root folder', () => {
const file = new Folder({
id: 1,
source: 'https://cloud.domain.com/remote.php/dav/trashbin/admin/trash/image.jpg.d1731053878',
owner: 'admin',
permissions: Permission.READ,
})
expect(action.enabled).toBeDefined()
expect(action.enabled!([file], view)).toBe(false)
})
})
describe('View in folder action execute tests', () => {

5
apps/files/src/actions/viewInFolderAction.ts
View file

@ -36,6 +36,11 @@ export const action = new FileAction({
return false
}
// Can only view files that are in the user root folder
if (!node.root?.startsWith('/files')) {
return false
}
if (node.permissions === Permission.NONE) {
return false
}