Mirrors/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2026-07-17 16:36:49 +00:00
Code Issues Projects Releases Wiki Activity

fix: check download permission when sharing permission is enabled (#5875)

Browse source
This commit is contained in:
Ariel Leyva 2026-04-04 03:11:21 -04:00 • committed by GitHub
parent 860c19ddf5
commit 0f39bd055e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
http/users.go
View file

@ -156,6 +156,10 @@ var userPostHandler = withAdmin(func(w http.ResponseWriter, r *http.Request, d *
return http.StatusBadRequest, err
}
if req.Data.Perm.Share && !req.Data.Perm.Download {
return http.StatusBadRequest, fberrors.ErrShareRequiresDownload
}
userHome, err := d.settings.MakeUserDir(req.Data.Username, req.Data.Scope, d.server.Root)
if err != nil {
log.Printf("create user: failed to mkdir user home dir: [%s]", userHome)
@ -204,6 +208,14 @@ var userPutHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request
return http.StatusBadRequest, nil
}
for _, field := range req.Which {
if strings.ToLower(field) == "perm" || strings.ToLower(field) == "all" {
if req.Data.Perm.Share && !req.Data.Perm.Download {
return http.StatusBadRequest, fberrors.ErrShareRequiresDownload
}
}
}
if len(req.Which) == 0 || (len(req.Which) == 1 && req.Which[0] == "all") {
if !d.user.Perm.Admin {
return http.StatusForbidden, nil