groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-25 12:51:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update bulk download endpoint ensure items are from the same library requested

Browse source
This commit is contained in:
advplyr 2026-04-19 16:20:31 -05:00
parent 39adefb632
commit b7e8a0474a
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
server/controllers/LibraryController.js
View file

@ -1435,10 +1435,15 @@ class LibraryController {
const libraryItems = await Database.libraryItemModel.findAll({ const libraryItems = await Database.libraryItemModel.findAll({
attributes: ['id', 'libraryId', 'path', 'isFile'], attributes: ['id', 'libraryId', 'path', 'isFile'],
where: { where: {
id: itemIds id: itemIds,
libraryId: req.library.id
} }
}) })
if (libraryItems.length < itemIds.length) {
Logger.warn(`[LibraryController] User "${req.user.username}" requested ${itemIds.length} items but only ${libraryItems.length} are in library "${req.library.id}"`)
}
Logger.info(`[LibraryController] User "${req.user.username}" requested download for items "${itemIds}"`) Logger.info(`[LibraryController] User "${req.user.username}" requested download for items "${itemIds}"`)
const filename = `LibraryItems-${Date.now()}.zip` const filename = `LibraryItems-${Date.now()}.zip`