webclient: hide preview button when user lacks download permission - #2229
Open
rupivbluegreen wants to merge 1 commit into
Open
webclient: hide preview button when user lacks download permission#2229rupivbluegreen wants to merge 1 commit into
rupivbluegreen wants to merge 1 commit into
Conversation
The eye/preview button in the file listing was rendered for every file matching a supported preview extension, regardless of whether the user had download permission. Clicking it always led to a permission error from the editfile/preview endpoint, producing confusing UX and spurious security/pen-test reports. Gate the preview-button branch on .CanDownload so the action is only offered when the server would actually honor it. The underlying server-side check is unchanged. Fixes drakkan#2149 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
|
Owner
|
Thanks for the contribution. Before we can review or merge it, we require contributors to sign our CLA (not sure if you are a human or an AI agent). Also, we already have a more complete fix for this small enhancement in SFTPGo Enterprise, and we may backport it to the open-source version in the future. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2149.
The eye/preview button in the WebClient file listing rendered for every supported preview extension (image / audio-video / PDF / text-editor) regardless of whether the user had
PermDownloadfor the directory. Clicking it always hit the editfile/preview endpoint, which then errored out withCannot open file editor: You do not have the required permissions.This produced:
Change
templates/webclient/files.html: wrap the preview-button switch (lines ~680–747) in a{{- if .CanDownload}} ... {{- end}}block, matching the existing//{{- if not .ShareUploadBaseURL}}convention used a few lines below.filesPage.CanDownloadis already populated correctly on both code paths (renderFilesPagefor the regular view,renderSharedFilesPagefor shares), so no Go-side wiring was required.The server-side authorization in
handleClientEditFile/getFileReaderis unchanged — this PR is purely a UI fix; it does not change what the server allows.Test plan
go build ./...go vet ./...TestFilesPageHidesViewerWithoutDownloadPermissionininternal/httpd/internal_test.gorenders thefiles.htmltemplate withCanDownload: trueandCanDownload: falseand asserts the preview-button markers (data-iv-name=for the image case,supportedEditExtensions.includes(extension)for the editor case) are present in the first and absent in the second.TestRenderInvalidTemplate,TestRenderUnexistingFolder, and theTestStaticFiles*/TestWebClient*/TestWebUserShare*test families still pass.Out of scope
edit_urlfield on the directory-listing JSON (internal/httpd/webclient.go:1269). The server-side check is the source of truth; hiding the button is sufficient for the UX bug.