groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-24 18:21:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Merge pull request #5388 from mikiher/fix/bulk-download-permissions
Some checks are pending
CodeQL / Analyze (push) Waiting to run
Details
Build and Push Docker Image / build (push) Waiting to run
Details
Integration Test / build and test (push) Waiting to run
Details
Run Unit Tests / Run Unit Tests (push) Waiting to run
Details

Browse source 
Enforce per-item access checks on bulk library download
This commit is contained in:
advplyr 2026-07-21 18:34:13 -04:00 • committed by GitHub
commit d063d851e1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 187 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
server/controllers/LibraryController.js
View file

@ -1432,14 +1432,17 @@ class LibraryController {
const itemIds = req.query.ids.split(',')
const libraryItems = await Database.libraryItemModel.findAll({
attributes: ['id', 'libraryId', 'path', 'isFile'],
where: {
id: itemIds,
libraryId: req.library.id
}
const libraryItems = await Database.libraryItemModel.findAllExpandedWhere({
id: itemIds,
libraryId: req.library.id
})
for (const libraryItem of libraryItems) {
if (!req.user.checkCanAccessLibraryItem(libraryItem)) {
return res.sendStatus(403)
}
}
if (libraryItems.length < itemIds.length) {
Logger.warn(`[LibraryController] User "${req.user.username}" requested ${itemIds.length} items but only ${libraryItems.length} are in library "${req.library.id}"`)
}