security: enforce recursive delete authorization

2026-09-21 21:37:32 +08:00
parent 3d865259fc
commit ea6999cddd
2 changed files with 27 additions and 1 deletions
@@ -336,6 +336,10 @@ func (s *Server) remove(w http.ResponseWriter, r *http.Request) {
 			writeJSONError(w, http.StatusForbidden, "has no privilege")
 			return
 		}
+		if e := checkDeleteTree(s.Store, a, p); e != nil {
+			writeJSONError(w, http.StatusForbidden, "has no privilege")
+			return
+		}
 		if e := s.removePath(p); e != nil {
 			http.Error(w, e.Error(), 500)
 			return