From 166583db632e088e9f0adce30aec43bb9d9019f4 Mon Sep 17 00:00:00 2001 From: Henrique Dias Date: Wed, 3 Jun 2026 11:43:22 +0200 Subject: [PATCH] fix: disallow shares for non-existent paths --- http/share.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/http/share.go b/http/share.go index ec95d066..a0a15dc9 100644 --- a/http/share.go +++ b/http/share.go @@ -99,6 +99,13 @@ var shareDeleteHandler = withPermShare(func(_ http.ResponseWriter, r *http.Reque }) var sharePostHandler = withPermShare(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) { + // Only allow sharing paths that currently exist. Otherwise a share could be + // created for a non-existent path and would silently start exposing + // whatever file later appears there. + if _, err := d.user.Fs.Stat(r.URL.Path); err != nil { + return errToStatus(err), err + } + var s *share.Link var body share.CreateBody if r.Body != nil {