openclaw/CHFS-NG
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce destination permissions on file operations

Browse Source
This commit is contained in:
OpenClaw Agent
2026-09-21 17:09:28 +08:00
parent 7791b3e7d3
commit f870d33fa1
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chfs-ng/internal/api/server.go
+9 -8
View File
@@ -162,12 +162,7 @@ func (s *Server) files(w http.ResponseWriter, r *http.Request) {
func (s *Server) newdir(w http.ResponseWriter, r *http.Request) {
_ = r.ParseMultipartForm(16 << 20)
_ = r.ParseForm()
a := account(r, s)
p := qpath(r)
if !a.MaskFor(p).HasWrite() {
http.Error(w, "forbidden", 403)
return
}
if p == "" {
p = strings.Trim(strings.ReplaceAll(r.FormValue("filepath"), "\\", "/"), "/")
}
@@ -181,6 +176,11 @@ func (s *Server) newdir(w http.ResponseWriter, r *http.Request) {
http.Error(w, "filepath required", 400)
return
}
a := account(r, s)
if !a.MaskFor(p).HasWrite() {
http.Error(w, "forbidden", 403)
return
}
if e := s.Store.MkdirAll(p); e != nil {
http.Error(w, e.Error(), 500)
return
@@ -192,7 +192,7 @@ func (s *Server) rename(w http.ResponseWriter, r *http.Request) {
a := account(r, s)
old := strings.Trim(r.FormValue("old"), "/")
neu := strings.Trim(r.FormValue("new"), "/")
if !a.MaskFor(old).HasWrite() {
if old == "" || neu == "" || !a.MaskFor(old).HasWrite() || !a.MaskFor(path.Dir(neu)).HasWrite() {
http.Error(w, "forbidden", 403)
return
}
@@ -211,8 +211,9 @@ func (s *Server) remove(w http.ResponseWriter, r *http.Request) {
if len(items) == 0 {
items = r.Form["path"]
}
for _, p := range items {
if !a.MaskFor(p).HasDelete() {
for _, raw := range items {
p := strings.Trim(strings.ReplaceAll(raw, "\\", "/"), "/")
if p == "" || !a.MaskFor(p).HasDelete() {
http.Error(w, "forbidden", 403)
return
}