openclaw/CHFS-NG
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce destination permissions on file operations

Browse Source
This commit is contained in:
OpenClaw Agent
2026-09-21 17:09:28 +08:00
parent 7791b3e7d3
commit f870d33fa1
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chfs-ng/internal/api/server.go
+9 -8
View File
@@ -162,12 +162,7 @@ func (s *Server) files(w http.ResponseWriter, r *http.Request) {
func (s *Server) newdir(w http.ResponseWriter, r *http.Request) { func (s *Server) newdir(w http.ResponseWriter, r *http.Request) {
_ = r.ParseMultipartForm(16 << 20) _ = r.ParseMultipartForm(16 << 20)
_ = r.ParseForm() _ = r.ParseForm()
a := account(r, s)
p := qpath(r) p := qpath(r)
if !a.MaskFor(p).HasWrite() {
http.Error(w, "forbidden", 403)
return
}
if p == "" { if p == "" {
p = strings.Trim(strings.ReplaceAll(r.FormValue("filepath"), "\\", "/"), "/") p = strings.Trim(strings.ReplaceAll(r.FormValue("filepath"), "\\", "/"), "/")
} }
@@ -181,6 +176,11 @@ func (s *Server) newdir(w http.ResponseWriter, r *http.Request) {
http.Error(w, "filepath required", 400) http.Error(w, "filepath required", 400)
return return
} }
a := account(r, s)
if !a.MaskFor(p).HasWrite() {
http.Error(w, "forbidden", 403)
return
}
if e := s.Store.MkdirAll(p); e != nil { if e := s.Store.MkdirAll(p); e != nil {
http.Error(w, e.Error(), 500) http.Error(w, e.Error(), 500)
return return
@@ -192,7 +192,7 @@ func (s *Server) rename(w http.ResponseWriter, r *http.Request) {
a := account(r, s) a := account(r, s)
old := strings.Trim(r.FormValue("old"), "/") old := strings.Trim(r.FormValue("old"), "/")
neu := strings.Trim(r.FormValue("new"), "/") neu := strings.Trim(r.FormValue("new"), "/")
if !a.MaskFor(old).HasWrite() { if old == "" || neu == "" || !a.MaskFor(old).HasWrite() || !a.MaskFor(path.Dir(neu)).HasWrite() {
http.Error(w, "forbidden", 403) http.Error(w, "forbidden", 403)
return return
} }
@@ -211,8 +211,9 @@ func (s *Server) remove(w http.ResponseWriter, r *http.Request) {
if len(items) == 0 { if len(items) == 0 {
items = r.Form["path"] items = r.Form["path"]
} }
for _, p := range items { for _, raw := range items {
if !a.MaskFor(p).HasDelete() { p := strings.Trim(strings.ReplaceAll(raw, "\\", "/"), "/")
if p == "" || !a.MaskFor(p).HasDelete() {
http.Error(w, "forbidden", 403) http.Error(w, "forbidden", 403)
return return
} }