groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-23 03:41:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Update podcast create path validation & fix relPath

Browse source
This commit is contained in:
advplyr 2026-04-17 16:51:22 -05:00
parent 455e605162
commit 09fa0b38f5
1 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
server/controllers/PodcastController.js
View file

@ -7,7 +7,7 @@ const Database = require('../Database')
const fs = require('../libs/fsExtra') const fs = require('../libs/fsExtra')
const { getPodcastFeed, findMatchingEpisodes } = require('../utils/podcastUtils') const { getPodcastFeed, findMatchingEpisodes } = require('../utils/podcastUtils')
const { getFileTimestampsWithIno, filePathToPOSIX } = require('../utils/fileUtils') const { getFileTimestampsWithIno, filePathToPOSIX, isSameOrSubPath } = require('../utils/fileUtils')
const { validateUrl } = require('../utils/index') const { validateUrl } = require('../utils/index')
const htmlSanitizer = require('../utils/htmlSanitizer') const htmlSanitizer = require('../utils/htmlSanitizer')
@ -58,8 +58,18 @@ class PodcastController {
return res.status(404).send('Folder not found') return res.status(404).send('Folder not found')
} }
if (typeof payload.path !== 'string' || !payload.path.trim()) {
return res.status(400).send('Invalid request body. "path" must be a non-empty string')
}
const libraryFolderPath = filePathToPOSIX(folder.path)
const podcastPath = filePathToPOSIX(payload.path) const podcastPath = filePathToPOSIX(payload.path)
if (!isSameOrSubPath(libraryFolderPath, podcastPath)) {
Logger.error(`[PodcastController] Create: Podcast path is outside library folder "${libraryFolderPath}": "${podcastPath}"`)
return res.status(400).send('Podcast path must be inside the selected library folder')
}
// Check if a library item with this podcast folder exists already // Check if a library item with this podcast folder exists already
const existingLibraryItem = const existingLibraryItem =
(await Database.libraryItemModel.count({ (await Database.libraryItemModel.count({
@ -83,7 +93,7 @@ class PodcastController {
const libraryItemFolderStats = await getFileTimestampsWithIno(podcastPath) const libraryItemFolderStats = await getFileTimestampsWithIno(podcastPath)
let relPath = payload.path.replace(folder.fullPath, '') let relPath = podcastPath.replace(libraryFolderPath, '')
if (relPath.startsWith('/')) relPath = relPath.slice(1) if (relPath.startsWith('/')) relPath = relPath.slice(1)
let newLibraryItem = null let newLibraryItem = null