fix(files): check that node is in user root folder for view-in-folder action

Signed-off-by: skjnldsv <skjnldsv@protonmail.com>

diff --git a/apps/files/src/actions/viewInFolderAction.spec.ts b/apps/files/src/actions/viewInFolderAction.spec.ts
index 8aa8bc81922b27ef973f2121242d4e4ae293d522..bd618c8a89fa04b0ad089410ed8b3a03bdfea436 100644 (file)
--- a/apps/files/src/actions/viewInFolderAction.spec.ts
+++ b/apps/files/src/actions/viewInFolderAction.spec.ts
@@ -109,6 +109,18 @@ describe('View in folder action enabled tests', () => {
                expect(action.enabled).toBeDefined()
                expect(action.enabled!([folder], view)).toBe(false)
        })
+
+       test('Disabled for files outside the user root folder', () => {
+               const file = new Folder({
+                       id: 1,
+                       source: 'https://cloud.domain.com/remote.php/dav/trashbin/admin/trash/image.jpg.d1731053878',
+                       owner: 'admin',
+                       permissions: Permission.READ,
+               })
+
+               expect(action.enabled).toBeDefined()
+               expect(action.enabled!([file], view)).toBe(false)
+       })
 })
 
 describe('View in folder action execute tests', () => {

diff --git a/apps/files/src/actions/viewInFolderAction.ts b/apps/files/src/actions/viewInFolderAction.ts
index 9a9775d1c6501ef93cfa8a8b3fd1314927cc721e..eb145dc409f6878b78ac5b770fa115453bf5cd20 100644 (file)
--- a/apps/files/src/actions/viewInFolderAction.ts
+++ b/apps/files/src/actions/viewInFolderAction.ts
@@ -36,6 +36,11 @@ export const action = new FileAction({
                        return false
                }
 
+               // Can only view files that are in the user root folder
+               if (!node.root?.startsWith('/files')) {
+                       return false
+               }
+
                if (node.permissions === Permission.NONE) {
                        return false
                }