diff options
| author | skjnldsv <skjnldsv@protonmail.com> | 2024-11-08 09:23:12 +0100 |
|---|---|---|
| committer | nextcloud-command <nextcloud-command@users.noreply.github.com> | 2024-11-12 22:39:17 +0000 |
| commit | a2a16936c3ce307b0043799a33572586cedb9eaa (patch) | |
| tree | e3ed0b50153b10c6612fa7424225775676a2dbfc /apps | |
| parent | 219c508fa3fab2359ac2ef0129d7f7b23c364aba (diff) | |
| download | nextcloud-server-a2a16936c3ce307b0043799a33572586cedb9eaa.tar.gz nextcloud-server-a2a16936c3ce307b0043799a33572586cedb9eaa.zip | |
fix(files): check that node is in user root folder for view-in-folder action
Signed-off-by: skjnldsv <skjnldsv@protonmail.com>
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/files/src/actions/viewInFolderAction.spec.ts | 12 | ||||
| -rw-r--r-- | apps/files/src/actions/viewInFolderAction.ts | 5 |
2 files changed, 17 insertions, 0 deletions
diff --git a/apps/files/src/actions/viewInFolderAction.spec.ts b/apps/files/src/actions/viewInFolderAction.spec.ts index 14b431f78cc..99ea1d23b8c 100644 --- a/apps/files/src/actions/viewInFolderAction.spec.ts +++ b/apps/files/src/actions/viewInFolderAction.spec.ts @@ -126,6 +126,18 @@ describe('View in folder action enabled tests', () => { expect(action.enabled).toBeDefined() expect(action.enabled!([folder], view)).toBe(false) }) + + test('Disabled for files outside the user root folder', () => { + const file = new Folder({ + id: 1, + source: 'https://cloud.domain.com/remote.php/dav/trashbin/admin/trash/image.jpg.d1731053878', + owner: 'admin', + permissions: Permission.READ, + }) + + expect(action.enabled).toBeDefined() + expect(action.enabled!([file], view)).toBe(false) + }) }) describe('View in folder action execute tests', () => { diff --git a/apps/files/src/actions/viewInFolderAction.ts b/apps/files/src/actions/viewInFolderAction.ts index 6498e9aa786..c1ad02135b2 100644 --- a/apps/files/src/actions/viewInFolderAction.ts +++ b/apps/files/src/actions/viewInFolderAction.ts @@ -47,6 +47,11 @@ export const action = new FileAction({ return false } + // Can only view files that are in the user root folder + if (!node.root?.startsWith('/files')) { + return false + } + if (node.permissions === Permission.NONE) { return false } |