fix: check permissions at copy/move source and destination (#181)

lib/handler.go

@@ -107,14 +107,22 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		zap.L().Info("user authorized", zap.String("username", username))
 	}
 
-	// Checks for user permissions relatively to this PATH.
-	allowed := user.Allowed(r, func(destination string) bool {
+	// Cleanup destination header if it's present by stripping out the prefix
+	// and only keeping the path.
+	if destination := r.Header.Get("Destination"); destination != "" {
 		u, err := url.Parse(destination)
-		if err != nil {
-			return false
+		if err == nil {
+			destination = strings.TrimPrefix(u.Path, user.Prefix)
+			if !strings.HasPrefix(destination, "/") {
+				destination = "/" + destination
+			}
+			r.Header.Set("Destination", destination)
 		}
-		path := strings.TrimPrefix(u.Path, user.Prefix)
-		_, err = user.FileSystem.Stat(r.Context(), path)
+	}
+
+	// Checks for user permissions relatively to this PATH.
+	allowed := user.Allowed(r, func(filename string) bool {
+		_, err := user.FileSystem.Stat(r.Context(), filename)
 		return !os.IsNotExist(err)
 	})