Fix pathexists filepath back to posix

Merge pull request #4398 from advplyr/pathexists_user_access
Update pathexists endpoint to check user has access to library
2026-07-04 08:21:35 +00:00 · 2025-06-11 16:37:07 -05:00 · 2025-06-11 16:31:14 -05:00 · 2025-06-11 16:14:51 -05:00 · 2025-06-11 16:04:18 -05:00
2 changed files with 13 additions and 1 deletions
--- a/server/controllers/FileSystemController.js
+++ b/server/controllers/FileSystemController.js
@ -108,7 +108,13 @@ class FileSystemController {
      return res.sendStatus(404)
    }

-    const filepath = Path.join(libraryFolder.path, directory)
+    if (!req.user.checkCanAccessLibrary(libraryFolder.libraryId)) {
+      Logger.error(`[FileSystemController] User "${req.user.username}" attempting to check path exists for library "${libraryFolder.libraryId}" without access`)
+      return res.sendStatus(403)
+    }
+
+    let filepath = Path.join(libraryFolder.path, directory)
+    filepath = fileUtils.filePathToPOSIX(filepath)

    // Ensure filepath is inside library folder (prevents directory traversal)
    if (!filepath.startsWith(libraryFolder.path)) {
--- a/server/controllers/MiscController.js
+++ b/server/controllers/MiscController.js
@ -59,6 +59,12 @@ class MiscController {
    if (!library) {
      return res.status(404).send('Library not found')
    }
+
+    if (!req.user.checkCanAccessLibrary(library.id)) {
+      Logger.error(`[MiscController] User "${req.user.username}" attempting to upload to library "${library.id}" without access`)
+      return res.sendStatus(403)
+    }
+
    const folder = library.libraryFolders.find((fold) => fold.id === folderId)
    if (!folder) {
      return res.status(404).send('Folder not found')
Author	SHA1	Message	Date
advplyr	22f6e86a12	Fix pathexists filepath back to posix Some checks are pending CodeQL / Analyze (push) Waiting to run Details Build and Push Docker Image / build (push) Waiting to run Details Integration Test / build and test (push) Waiting to run Details Run Unit Tests / Run Unit Tests (push) Waiting to run Details	2025-06-11 16:37:07 -05:00
advplyr	dc6783ea76	Merge pull request #4398 from advplyr/pathexists_user_access Update pathexists endpoint to check user has access to library	2025-06-11 16:31:14 -05:00
advplyr	a6f10ca48e	Update upload endpoint to check user has access to library	2025-06-11 16:14:51 -05:00
advplyr	aac01d6d9a	Update pathexists endpoint to check user has access to library	2025-06-11 16:04:18 -05:00