Commit graph

2 commits

Author SHA1 Message Date
Henrique Dias
f30fca636c
fix(share): delete exact directory share on trailing-slash delete (GHSA-pp88-jhwj-5qh5)
DeleteWithPathPrefix queried the share index with the raw path, so deleting a
directory through a trailing-slash path (e.g. DELETE /api/resources/a/) only
matched descendants like /a/child and missed the exact /a share, leaving it in
storage. If the same path was later recreated, the stale public share re-exposed
the new content. Normalize the path before the prefix query so the exact share
and its descendants are both removed. Adds a regression test.
2026-06-27 09:08:57 +02:00
Henrique Dias
0231b7ebdf
fix: cross-user unauthorized share-link deletion 2026-06-03 10:31:44 +02:00