From 209555c1d93845fa129bea450f9c25d595a3c60f Mon Sep 17 00:00:00 2001 From: KernelDeimos Date: Wed, 14 Aug 2024 17:19:23 -0400 Subject: [PATCH] feat: make public folders a config opt-in --- src/backend/src/services/auth/ACLService.js | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/backend/src/services/auth/ACLService.js b/src/backend/src/services/auth/ACLService.js index 9edd85cce..a036983e1 100644 --- a/src/backend/src/services/auth/ACLService.js +++ b/src/backend/src/services/auth/ACLService.js @@ -56,9 +56,11 @@ class ACLService extends BaseService { } // Hard rule: anyone and anything can read /user/public directories - const public_modes = ['read', 'list', 'see']; - if ( public_modes.includes(mode) ) { - if ( await fsNode.isPublic() ) return true; + if ( this.global_config.enable_public_folders ) { + const public_modes = ['read', 'list', 'see']; + if ( public_modes.includes(mode) ) { + if ( await fsNode.isPublic() ) return true; + } } // Access tokens only work if the authorizer has permission