file_manager: fix internal access check
Include the reserved file check in the `can_access_path()` method. This fixes a potential vulnerability in the notifier where it may be possible to attach a reserved file to a notification. Signed-off-by: Eric Callahan <arksine.code@gmail.com>
This commit is contained in:
parent
fe9a9899e3
commit
a4b496d135
|
@ -334,7 +334,7 @@ class FileManager:
|
|||
for registered in self.file_paths.values():
|
||||
reg_root_path = pathlib.Path(registered).resolve()
|
||||
if reg_root_path in path.parents:
|
||||
return True
|
||||
return not self.check_reserved_path(path, False, False)
|
||||
return False
|
||||
|
||||
def upload_queue_enabled(self) -> bool:
|
||||
|
|
Loading…
Reference in New Issue