allow zipping of files when it's forbidden on folders
Massimo Melina committed
Jun 20, 2024 at 23:20 UTC
09e67daa9c06ebec3c2528b38dbe52831eb3e6b0
2 files changed
+5
-5
src/api.get_file_list.ts
+2
-2
@@ -38,9 +38,9 @@ export const get_file_list: ApiHandler = async ({ uri='/', offset, limit, search
38
const walker = walkNode(node, { ctx: admin ? undefined : ctx, onlyFolders, depth: search ? Infinity : 0 })
39
const onDirEntryHandlers = mapPlugins(plug => plug.onDirEntry)
40
const can_upload = admin || hasPermission(node, 'can_upload', ctx)
41
- const fakeChild = await applyParentToChild(undefined, node) // can we delete children
41
+ const fakeChild = await applyParentToChild({ source: 'x' }, node) // can we delete children
42
const can_delete = admin || hasPermission(fakeChild, 'can_delete', ctx)
43
- const can_archive = admin || hasPermission(node, 'can_archive', ctx)
43
+ const can_archive = admin || hasPermission(fakeChild, 'can_archive', ctx)
44
const can_comment = can_upload && areCommentsEnabled()
45
const can_overwrite = can_upload && (can_delete || !dontOverwriteUploading.get())
46
const comment = await getCommentFor(node.source)
src/zip.ts
+3
-3
@@ -13,11 +13,11 @@ import { HTTP_OK } from './const'
13
14
// expects 'node' to have had permissions checked by caller
15
export async function zipStreamFromFolder(node: VfsNode, ctx: Koa.Context) {
16
- if (statusCodeForMissingPerm(node, 'can_archive', ctx)) return
16
+ const list = wantArray(ctx.query.list)[0]?.split('*') // we are using * as separator because it cannot be used in a file name and doesn't need url encoding
17
+ if (!list && statusCodeForMissingPerm(node, 'can_archive', ctx)) return
18
ctx.status = HTTP_OK
19
ctx.mime = 'zip'
20
// ctx.query.list is undefined | string | string[]
20
- const list = wantArray(ctx.query.list)[0]?.split('*') // we are using * as separator because it cannot be used in a file name and doesn't need url encoding
21
const name = list?.length === 1 ? safeDecodeURIComponent(basename(list[0]!)) : getNodeName(node)
22
ctx.attachment((isWindowsDrive(name) ? name[0] : (name || 'archive')) + '.zip')
23
const filter = pattern2filter(String(ctx.query.search||''))
@@ -28,7 +28,7 @@ export async function zipStreamFromFolder(node: VfsNode, ctx: Koa.Context) {
28
if (!subNode)
29
continue
30
if (await nodeIsDirectory(subNode)) { // a directory needs to walked
31
- if (hasPermission(subNode, 'can_list',ctx)) {
31
+ if (hasPermission(subNode, 'can_list', ctx) && hasPermission(subNode, 'can_archive', ctx)) {
32
yield subNode // it could be empty
33
yield* walkNode(subNode, { ctx, prefixPath: decodeURI(uri) + '/', requiredPerm: 'can_archive' })
34
}