groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-23 17:51:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

fix(permissions): enforce per-item access on bulk library download

Browse source
This commit is contained in:
mikiher 2026-07-16 18:11:19 +03:00
parent 59c7d0275c
commit 32e4da8c92
2 changed files with 187 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
server/controllers/LibraryController.js
View file

@ -1432,14 +1432,17 @@ class LibraryController {
const itemIds = req.query.ids.split(',')
const libraryItems = await Database.libraryItemModel.findAll({
attributes: ['id', 'libraryId', 'path', 'isFile'],
where: {
id: itemIds,
libraryId: req.library.id
}
const libraryItems = await Database.libraryItemModel.findAllExpandedWhere({
id: itemIds,
libraryId: req.library.id
})
for (const libraryItem of libraryItems) {
if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
return res.sendStatus(403)
}
}
if (libraryItems.length < itemIds.length) {
Logger.warn(`[LibraryController] User "${req.user.username}" requested ${itemIds.length} items but only ${libraryItems.length} are in library "${req.library.id}"`)
}