From f870d33fa14bce12c5b498f1d33257f4b0d60260 Mon Sep 17 00:00:00 2001
From: OpenClaw Agent <openclaw@example.com>
Date: Mon, 21 Sep 2026 17:09:28 +0800
Subject: [PATCH] fix: enforce destination permissions on file operations

---
 chfs-ng/internal/api/server.go | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/chfs-ng/internal/api/server.go b/chfs-ng/internal/api/server.go
index 2f7c023..686a2e6 100644
--- a/chfs-ng/internal/api/server.go
+++ b/chfs-ng/internal/api/server.go
@@ -162,12 +162,7 @@ func (s *Server) files(w http.ResponseWriter, r *http.Request) {
 func (s *Server) newdir(w http.ResponseWriter, r *http.Request) {
 	_ = r.ParseMultipartForm(16 << 20)
 	_ = r.ParseForm()
-	a := account(r, s)
 	p := qpath(r)
-	if !a.MaskFor(p).HasWrite() {
-		http.Error(w, "forbidden", 403)
-		return
-	}
 	if p == "" {
 		p = strings.Trim(strings.ReplaceAll(r.FormValue("filepath"), "\\", "/"), "/")
 	}
@@ -181,6 +176,11 @@ func (s *Server) newdir(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "filepath required", 400)
 		return
 	}
+	a := account(r, s)
+	if !a.MaskFor(p).HasWrite() {
+		http.Error(w, "forbidden", 403)
+		return
+	}
 	if e := s.Store.MkdirAll(p); e != nil {
 		http.Error(w, e.Error(), 500)
 		return
@@ -192,7 +192,7 @@ func (s *Server) rename(w http.ResponseWriter, r *http.Request) {
 	a := account(r, s)
 	old := strings.Trim(r.FormValue("old"), "/")
 	neu := strings.Trim(r.FormValue("new"), "/")
-	if !a.MaskFor(old).HasWrite() {
+	if old == "" || neu == "" || !a.MaskFor(old).HasWrite() || !a.MaskFor(path.Dir(neu)).HasWrite() {
 		http.Error(w, "forbidden", 403)
 		return
 	}
@@ -211,8 +211,9 @@ func (s *Server) remove(w http.ResponseWriter, r *http.Request) {
 	if len(items) == 0 {
 		items = r.Form["path"]
 	}
-	for _, p := range items {
-		if !a.MaskFor(p).HasDelete() {
+	for _, raw := range items {
+		p := strings.Trim(strings.ReplaceAll(raw, "\\", "/"), "/")
+		if p == "" || !a.MaskFor(p).HasDelete() {
 			http.Error(w, "forbidden", 403)
 			return
 		}