file_manager: fix internal access check

Include the reserved file check in the `can_access_path()` method.  This
fixes a potential vulnerability in the notifier where it may be possible
to attach a reserved file to a notification.

Signed-off-by:  Eric Callahan <arksine.code@gmail.com>
This commit is contained in:
Eric Callahan 2023-01-08 07:17:43 -05:00
parent fe9a9899e3
commit a4b496d135
No known key found for this signature in database
GPG Key ID: 5A1EB336DFB4C71B
1 changed files with 1 additions and 1 deletions

View File

@ -334,7 +334,7 @@ class FileManager:
for registered in self.file_paths.values():
reg_root_path = pathlib.Path(registered).resolve()
if reg_root_path in path.parents:
return True
return not self.check_reserved_path(path, False, False)
return False
def upload_queue_enabled(self) -> bool: