https://gitlab.synchro.net/main/sbbs/-/commit/8fd69539c84646c42025e70e
Modified Files:
webv4/pages/002-files.xjs
Log Message:
webv4: don't list a file directory the user can't access
The Files page listed a directory's files whenever file_area.dir[] had an
entry for the requested code. file_area.dir has an entry for every
directory, marking the ones the user can't access (can_access false,
index -1); only the dir_list arrays are filtered. So anyone who knew or
guessed a directory's code could list its files, including a guest viewing
a directory configured NOT GUEST. Require can_access, as the download API already requires index >= 0. Downloads were not affected.
Co-Authored-By: Claude Opus 5.5 <
noreply@anthropic.com>
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net