archive/webdav
1
0
Fork 0
mirror of https://github.com/hacdias/webdav.git synced 2026-09-25 12:41:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: additive permissions

Browse Source
This commit is contained in:
Henrique Dias
2025-10-17 17:10:24 +02:00
parent 7ca822bcaf
commit 9bc219271c
2 changed files with 49 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/permissions.go
+3 -1
View File
@@ -56,9 +56,11 @@ func (p UserPermissions) Allowed(r *request, fileExists func(string) bool) bool
// we fail immediately. If no rule matches, we check the global permissions.
if r.method == "COPY" || r.method == "MOVE" {
dst := r.destination
ruleMatched := false
for i := len(p.Rules) - 1; i >= 0; i-- {
if p.Rules[i].Matches(dst) {
ruleMatched = true
if !p.Rules[i].Permissions.AllowedDestination(r, fileExists) {
return false
}
@@ -68,7 +70,7 @@ func (p UserPermissions) Allowed(r *request, fileExists func(string) bool) bool
}
}
if !p.Permissions.AllowedDestination(r, fileExists) {
if !ruleMatched && !p.Permissions.AllowedDestination(r, fileExists) {
return false
}
}