Cutlery/jellyfin
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2025-07-09 03:04:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8753 from thornbill/fix-items-access-backport

Browse Source
This commit is contained in:
Bond-009 2022-11-22 21:52:53 +01:00 committed by GitHub
commit 6fc8237242
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
Jellyfin.Api/Controllers/ItemsController.cs
View File

@ -270,30 +270,13 @@ namespace Jellyfin.Api.Controllers
includeItemTypes = new[] { BaseItemKind.Playlist }; includeItemTypes = new[] { BaseItemKind.Playlist };
} }
var enabledChannels = user!.GetPreferenceValues<Guid>(PreferenceKind.EnabledChannels);
bool isInEnabledFolder = Array.IndexOf(user.GetPreferenceValues<Guid>(PreferenceKind.EnabledFolders), item.Id) != -1
// Assume all folders inside an EnabledChannel are enabled
|| Array.IndexOf(enabledChannels, item.Id) != -1
// Assume all items inside an EnabledChannel are enabled
|| Array.IndexOf(enabledChannels, item.ChannelId) != -1;
var collectionFolders = _libraryManager.GetCollectionFolders(item);
foreach (var collectionFolder in collectionFolders)
{
if (user.GetPreferenceValues<Guid>(PreferenceKind.EnabledFolders).Contains(collectionFolder.Id))
{
isInEnabledFolder = true;
}
}
if (item is not UserRootFolder if (item is not UserRootFolder
&& !isInEnabledFolder // api keys can always access all folders
&& !user.HasPermission(PermissionKind.EnableAllFolders) && !ClaimHelpers.GetIsApiKey(User)
&& !user.HasPermission(PermissionKind.EnableAllChannels) // check the item is visible for the user
&& !string.Equals(collectionType, CollectionType.Folders, StringComparison.OrdinalIgnoreCase)) && !item.IsVisible(user))
{ {
_logger.LogWarning("{UserName} is not permitted to access Library {ItemName}.", user.Username, item.Name); _logger.LogWarning("{UserName} is not permitted to access Library {ItemName}", user!.Username, item.Name);
return Unauthorized($"{user.Username} is not permitted to access Library {item.Name}."); return Unauthorized($"{user.Username} is not permitted to access Library {item.Name}.");
} }

2
Jellyfin.Api/Controllers/LibraryController.cs
View File

@ -492,7 +492,7 @@ namespace Jellyfin.Api.Controllers
/// <response code="200">Media folders returned.</response> /// <response code="200">Media folders returned.</response>
/// <returns>List of user media folders.</returns> /// <returns>List of user media folders.</returns>
[HttpGet("Library/MediaFolders")] [HttpGet("Library/MediaFolders")]
[Authorize(Policy = Policies.DefaultAuthorization)] [Authorize(Policy = Policies.RequiresElevation)]
[ProducesResponseType(StatusCodes.Status200OK)] [ProducesResponseType(StatusCodes.Status200OK)]
public ActionResult<QueryResult<BaseItemDto>> GetMediaFolders([FromQuery] bool? isHidden) public ActionResult<QueryResult<BaseItemDto>> GetMediaFolders([FromQuery] bool? isHidden)
{ {