dtoro 6cbabda86b feat(sidecar): enforce per-user BasePath on all filesystem mutations ...

Folder create/rename/delete/move, photo move, heap convert, and file
rename now reject paths outside the caller's BasePath (403). Sources
resolved via PhotoPrism UIDs are re-checked in movePhotoFiles. The
USER_BASEPATHS reconciler also sets upload_path so client-app uploads
land inside the user's subtree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-03 12:46:00 +02:00

3.4 KiB

Raw Blame History

View Raw