mirror of
https://github.com/HeyPuter/puter.git
synced 2026-10-01 09:38:21 +00:00
Juan Fernando Castro
81d700d146
Creating a hosted subdomain gated `root_dir` on `write`, and hosting serves everything under that directory with the ACL deliberately bypassed. So a recipient of a `write` share could point a `*.puter.site` subdomain at the owner's folder and make the subtree world-readable — continuously, covering files the owner added later, with the row under the recipient's account where nothing the owner can list would show it. `update` had the same gate for a changed `root_dir`. `#checkPublishAccess` now decides both: the actor's own tree still takes `write`, anyone else's takes `manage` — "Can edit & share", the level that delegates the decision. Keyed on who owns the entry rather than asking for `manage` outright, which is what the ticket proposed. `manage`'s is-owner implicator declines to answer for app actors, so a flat `manage` would refuse every app publishing a directory its user handed it, with no way for the app to obtain the grant. The write check still runs first — it is what masks a directory the caller cannot see as a 404 — and `manage` satisfies every lower mode, so the order costs a manage-holder nothing. The GUI's Publish As Website item reuses the own-it-or-`manage` answer it already computes for sharing, so it is not offered where this would refuse. Docs state the rule on `hosting.create()` and in `share()`'s level list. Regression tests fail without the driver change: a write-share recipient is refused on create and on repointing an existing subdomain, while `manage` and the actor's own directory are accepted.