From 66b2562d0357c1b71ec245434730d59fbcc71114 Mon Sep 17 00:00:00 2001
From: Noah Hsu <i@nn.ci>
Date: Wed, 14 Sep 2022 19:57:39 +0800
Subject: [PATCH] fix: allow force root while fetch dirs (close #1671)

---
 server/handles/fsread.go | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/server/handles/fsread.go b/server/handles/fsread.go
index 3de4528a..031fb913 100644
--- a/server/handles/fsread.go
+++ b/server/handles/fsread.go
@@ -26,8 +26,9 @@ type ListReq struct {
 }
 
 type DirReq struct {
-	Path     string `json:"path" form:"path"`
-	Password string `json:"password" form:"password"`
+	Path      string `json:"path" form:"path"`
+	Password  string `json:"password" form:"password"`
+	ForceRoot bool   `json:"force_root" form:"force_root"`
 }
 
 type ObjResp struct {
@@ -93,7 +94,14 @@ func FsDirs(c *gin.Context) {
 		return
 	}
 	user := c.MustGet("user").(*model.User)
-	req.Path = stdpath.Join(user.BasePath, req.Path)
+	if req.ForceRoot {
+		if !user.IsAdmin() {
+			common.ErrorStrResp(c, "Permission denied", 403)
+			return
+		}
+	} else {
+		req.Path = stdpath.Join(user.BasePath, req.Path)
+	}
 	meta, err := db.GetNearestMeta(req.Path)
 	if err != nil {
 		if !errors.Is(errors.Cause(err), errs.MetaNotFound) {