diff --git a/server/controllers/FileSystemController.js b/server/controllers/FileSystemController.js index 4b0a94b39..edfd869c3 100644 --- a/server/controllers/FileSystemController.js +++ b/server/controllers/FileSystemController.js @@ -108,13 +108,7 @@ class FileSystemController { return res.sendStatus(404) } - if (!req.user.checkCanAccessLibrary(libraryFolder.libraryId)) { - Logger.error(`[FileSystemController] User "${req.user.username}" attempting to check path exists for library "${libraryFolder.libraryId}" without access`) - return res.sendStatus(403) - } - - let filepath = Path.join(libraryFolder.path, directory) - filepath = fileUtils.filePathToPOSIX(filepath) + const filepath = Path.join(libraryFolder.path, directory) // Ensure filepath is inside library folder (prevents directory traversal) if (!filepath.startsWith(libraryFolder.path)) { diff --git a/server/controllers/MiscController.js b/server/controllers/MiscController.js index c779bdd63..0e5ad1411 100644 --- a/server/controllers/MiscController.js +++ b/server/controllers/MiscController.js @@ -59,12 +59,6 @@ class MiscController { if (!library) { return res.status(404).send('Library not found') } - - if (!req.user.checkCanAccessLibrary(library.id)) { - Logger.error(`[MiscController] User "${req.user.username}" attempting to upload to library "${library.id}" without access`) - return res.sendStatus(403) - } - const folder = library.libraryFolders.find((fold) => fold.id === folderId) if (!folder) { return res.status(404).send('Folder not found')