From 967d5deeb79405ce7122c6124dac019b278ca70b Mon Sep 17 00:00:00 2001 From: Felix Ruhnow Date: Mon, 18 Feb 2019 18:29:58 +0100 Subject: checking user-permission in GetQueryResult to prevent accessing the library without permission but having a link. (+added myself as contributor. forgot last time bout that) --- MediaBrowser.Api/UserLibrary/ItemsService.cs | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'MediaBrowser.Api/UserLibrary') diff --git a/MediaBrowser.Api/UserLibrary/ItemsService.cs b/MediaBrowser.Api/UserLibrary/ItemsService.cs index 3ae7da0073..895c88dc80 100644 --- a/MediaBrowser.Api/UserLibrary/ItemsService.cs +++ b/MediaBrowser.Api/UserLibrary/ItemsService.cs @@ -12,6 +12,7 @@ using MediaBrowser.Model.Entities; using MediaBrowser.Model.Globalization; using MediaBrowser.Model.Querying; using MediaBrowser.Model.Services; +using Microsoft.Extensions.Logging; namespace MediaBrowser.Api.UserLibrary { @@ -227,6 +228,16 @@ namespace MediaBrowser.Api.UserLibrary request.IncludeItemTypes = "Playlist"; } + if (!user.Policy.EnabledFolders.Where(i => new Guid(i).Equals(item.Id)).Any() && !user.Policy.EnableAllFolders) + { + Logger.LogWarning($"{user.Name} is not permitted to access Library {item.Name}."); + return new QueryResult + { + Items = new BaseItem[0], + TotalRecordCount = 0 + }; + } + if (request.Recursive || !string.IsNullOrEmpty(request.Ids) || user == null) { return folder.GetItems(GetItemsQuery(request, dtoOptions, user)); -- cgit v1.2.3