Fix API symlink handling: allow workspace/ files access via clawd/workspace symlink
This commit is contained in:
@@ -122,7 +122,8 @@ class TaskBoardHandler(SimpleHTTPRequestHandler):
|
||||
for base in allowed_dirs:
|
||||
try:
|
||||
candidate = (base / path).resolve()
|
||||
if str(candidate).startswith(str(base)):
|
||||
# Check if candidate is within ANY allowed directory (handles symlinks)
|
||||
if any(str(candidate).startswith(str(d)) for d in allowed_dirs):
|
||||
target = candidate
|
||||
workspace = base
|
||||
break
|
||||
@@ -669,7 +670,8 @@ class TaskBoardHandler(SimpleHTTPRequestHandler):
|
||||
for base in allowed_dirs:
|
||||
try:
|
||||
candidate = (base / path).resolve()
|
||||
if str(candidate).startswith(str(base)):
|
||||
# Check if candidate is within ANY allowed directory (handles symlinks)
|
||||
if any(str(candidate).startswith(str(d)) for d in allowed_dirs):
|
||||
target = candidate
|
||||
workspace = base
|
||||
break
|
||||
|
||||
Reference in New Issue
Block a user