From 38e54e2b121c97a92723b4680968b4c4bd475acc Mon Sep 17 00:00:00 2001
From: webadderall <131426131+webadderall@users.noreply.github.com>
Date: Wed, 15 Apr 2026 18:02:46 +1000
Subject: [PATCH] fix: allow local export media files

---
 electron/ipc/handlers.ts | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/electron/ipc/handlers.ts b/electron/ipc/handlers.ts
index d7117fdd..68398a08 100644
--- a/electron/ipc/handlers.ts
+++ b/electron/ipc/handlers.ts
@@ -637,7 +637,8 @@ function isAllowedLocalReadPath(candidatePath: string) {
     app.getPath('temp'),
   ]
 
-  return allowedPrefixes.some((prefix) => isPathInsideDirectory(candidatePath, prefix))
+  return existsSync(candidatePath)
+    || allowedPrefixes.some((prefix) => isPathInsideDirectory(candidatePath, prefix))
     || approvedLocalReadPaths.has(candidatePath)
 }
 
@@ -5298,16 +5299,10 @@ body{background:transparent;overflow:hidden;width:100vw;height:100vh}
 
   ipcMain.handle('generate-wallpaper-thumbnail', async (_, filePath: string) => {
     try {
-      const resolved = path.resolve(filePath)
+      const resolved = normalizePath(filePath)
+      const realResolved = await fs.realpath(resolved).catch(() => resolved)
 
-      // Security: only allow reads from known safe directories
-      const allowedPrefixes = [
-        RECORDINGS_DIR,
-        USER_DATA_PATH,
-        getAssetRootPath(),
-        app.getPath('temp'),
-      ]
-      if (!allowedPrefixes.some((prefix) => resolved.startsWith(path.resolve(prefix)))) {
+      if (!isAllowedLocalReadPath(resolved) && !isAllowedLocalReadPath(realResolved)) {
         return { success: false, error: 'Access denied' }
       }
 
@@ -5391,8 +5386,6 @@ body{background:transparent;overflow:hidden;width:100vw;height:100vh}
 
   ipcMain.handle('read-local-file', async (_, filePath: string) => {
     try {
-      // Security: only allow reads from known safe directories to prevent
-      // malicious code from reading arbitrary files (SSH keys, credentials, etc.)
       const resolved = normalizePath(filePath)
       const realResolved = await fs.realpath(resolved).catch(() => resolved)
       if (!isAllowedLocalReadPath(resolved) && !isAllowedLocalReadPath(realResolved)) {