fix: frontend: upload button shouldn't be visible on virtual folders
Massimo Melina committed
Feb 24, 2023 at 14:00 UTC
de6b293b97b0e22c64e307d29c83c56b1af39c0b
3 files changed
+6
-6
src/frontEndApis.ts
+2
-3
@@ -48,11 +48,10 @@ export const frontEndApis: ApiHandlers = {
48
const parentNode = await urlToNode(path, ctx)
49
if (!parentNode)
50
return new ApiError(HTTP_NOT_FOUND, 'parent not found')
51
- const { source } = parentNode
52
- if (!source || !hasPermission(parentNode, 'can_upload', ctx))
51
+ if (!hasPermission(parentNode, 'can_upload', ctx))
52
return new ApiError(HTTP_FORBIDDEN)
53
try {
55
- await mkdir(join(source, name))
54
+ await mkdir(join(parentNode.source!, name))
55
return {}
56
}
57
catch(e:any) {
src/upload.ts
+2
-2
@@ -21,9 +21,9 @@ const dontOverwriteUploading = defineConfig('dont_overwrite_uploading', false)
21
const waitingToBeDeleted: Record<string, ReturnType<typeof setTimeout>> = {}
22
23
export function uploadWriter(base: VfsNode, path: string, ctx: Koa.Context) {
24
- if (!base.source || !hasPermission(base, 'can_upload', ctx))
24
+ if (!hasPermission(base, 'can_upload', ctx))
25
return fail(base.can_upload === false ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED)
26
- const fullPath = join(base.source, path)
26
+ const fullPath = join(base.source!, path)
27
const dir = dirname(fullPath)
28
const min = minAvailableMb.get() * (1 << 20)
29
const reqSize = Number(ctx.headers["content-length"])
src/vfs.ts
+2
-1
@@ -149,7 +149,8 @@ export async function nodeIsDirectory(node: VfsNode) {
149
}
150
151
export function hasPermission(node: VfsNode, perm: keyof VfsPerm, ctx: Koa.Context): boolean {
152
- return matchWho(node[perm] ?? defaultPerms[perm], ctx)
152
+ return (node.source || perm !== 'can_upload') // Upload possible only if we know where to store. First check node.source because is supposedly faster.
153
+ && matchWho(node[perm] ?? defaultPerms[perm], ctx)
154
&& (perm !== 'can_see' || hasPermission(node, 'can_read', ctx)) // can_see is used to hide something you nonetheless can_read, so you MUST also can_read
155
}
156