fix(files): check that node is in user root folder for view-in-folder action

Signed-off-by: skjnldsv <skjnldsv@protonmail.com>

diff --git a/apps/files/src/actions/viewInFolderAction.spec.ts b/apps/files/src/actions/viewInFolderAction.spec.ts
index 14b431f78cc9e68909192cfaf490b450990e0bf3..99ea1d23b8c064fb06193667ba21b5f99a748e44 100644 (file)
--- a/apps/files/src/actions/viewInFolderAction.spec.ts
+++ b/apps/files/src/actions/viewInFolderAction.spec.ts
@@ -126,6 +126,18 @@ describe('View in folder action enabled tests', () => {
                expect(action.enabled).toBeDefined()
                expect(action.enabled!([folder], view)).toBe(false)
        })
+
+       test('Disabled for files outside the user root folder', () => {
+               const file = new Folder({
+                       id: 1,
+                       source: 'https://cloud.domain.com/remote.php/dav/trashbin/admin/trash/image.jpg.d1731053878',
+                       owner: 'admin',
+                       permissions: Permission.READ,
+               })
+
+               expect(action.enabled).toBeDefined()
+               expect(action.enabled!([file], view)).toBe(false)
+       })
 })
 
 describe('View in folder action execute tests', () => {

diff --git a/apps/files/src/actions/viewInFolderAction.ts b/apps/files/src/actions/viewInFolderAction.ts
index 6498e9aa7863cbdb0923a8e3e5e5f81a4c6a8c04..c1ad02135b2958abd324c24ef8644663bbf53e0d 100644 (file)
--- a/apps/files/src/actions/viewInFolderAction.ts
+++ b/apps/files/src/actions/viewInFolderAction.ts
@@ -47,6 +47,11 @@ export const action = new FileAction({
                        return false
                }
 
+               // Can only view files that are in the user root folder
+               if (!node.root?.startsWith('/files')) {
+                       return false
+               }
+
                if (node.permissions === Permission.NONE) {
                        return false
                }