lee/Recordly
1
0
Fork 0
mirror of https://github.com/webadderallorg/Recordly.git synced 2026-09-28 16:55:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow local export media files

Browse Source
This commit is contained in:
webadderall
2026-04-15 18:02:46 +10:00
parent 60d364a4ed
commit 38e54e2b12
1 changed files with 5 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
electron/ipc/handlers.ts
+5 -12
View File
@@ -637,7 +637,8 @@ function isAllowedLocalReadPath(candidatePath: string) {
app.getPath('temp'),
]
return allowedPrefixes.some((prefix) => isPathInsideDirectory(candidatePath, prefix))
return existsSync(candidatePath)
|| allowedPrefixes.some((prefix) => isPathInsideDirectory(candidatePath, prefix))
|| approvedLocalReadPaths.has(candidatePath)
}
@@ -5298,16 +5299,10 @@ body{background:transparent;overflow:hidden;width:100vw;height:100vh}
ipcMain.handle('generate-wallpaper-thumbnail', async (_, filePath: string) => {
try {
const resolved = path.resolve(filePath)
const resolved = normalizePath(filePath)
const realResolved = await fs.realpath(resolved).catch(() => resolved)
// Security: only allow reads from known safe directories
const allowedPrefixes = [
RECORDINGS_DIR,
USER_DATA_PATH,
getAssetRootPath(),
app.getPath('temp'),
]
if (!allowedPrefixes.some((prefix) => resolved.startsWith(path.resolve(prefix)))) {
if (!isAllowedLocalReadPath(resolved) && !isAllowedLocalReadPath(realResolved)) {
return { success: false, error: 'Access denied' }
}
@@ -5391,8 +5386,6 @@ body{background:transparent;overflow:hidden;width:100vw;height:100vh}
ipcMain.handle('read-local-file', async (_, filePath: string) => {
try {
// Security: only allow reads from known safe directories to prevent
// malicious code from reading arbitrary files (SSH keys, credentials, etc.)
const resolved = normalizePath(filePath)
const realResolved = await fs.realpath(resolved).catch(() => resolved)
if (!isAllowedLocalReadPath(resolved) && !isAllowedLocalReadPath(realResolved)) {