From e669f3b3f401ff594711d5178d33277a7e069367 Mon Sep 17 00:00:00 2001
From: Weidi Deng <weidi_deng@icloud.com>
Date: Wed, 16 Dec 2020 11:57:58 +0800
Subject: [PATCH] check root dir name if present

---
 frontend/src/views/Share.vue |  2 +-
 http/public.go               | 22 ++++++++++++++++------
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/frontend/src/views/Share.vue b/frontend/src/views/Share.vue
index eae60c7e..8e5f8b22 100644
--- a/frontend/src/views/Share.vue
+++ b/frontend/src/views/Share.vue
@@ -1,7 +1,7 @@
 <template>
   <div v-if="loaded">
     <div id="breadcrumbs">
-      <router-link :to="'/share/' + hash + '/' + this.path.split('/')[0]" :aria-label="$t('files.home')" :title="$t('files.home')">
+      <router-link :to="'/share/' + hash" :aria-label="$t('files.home')" :title="$t('files.home')">
         <i class="material-icons">home</i>
       </router-link>
 
diff --git a/http/public.go b/http/public.go
index 8bd207cc..b48b1fd6 100644
--- a/http/public.go
+++ b/http/public.go
@@ -2,19 +2,25 @@ package http
 
 import (
 	"net/http"
+	"path/filepath"
 	"strings"
 
 	"github.com/filebrowser/filebrowser/v2/files"
+	libErrors "github.com/filebrowser/filebrowser/v2/errors"
 )
 
 var withHashFile = func(fn handleFunc) handleFunc {
 	return func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
-		id, path := ifPathWithName(r)
+		id, rootName, path := ifPathWithName(r)
 		link, err := d.store.Share.GetByHash(id)
 		if err != nil {
 			return errToStatus(err), err
 		}
 
+		if rootName != "" && filepath.Base(rootName) != filepath.Base(link.Path) {
+			return errToStatus(libErrors.ErrNotExist), libErrors.ErrNotExist
+		}
+
 		user, err := d.store.Users.Get(d.server.Root, link.UserID)
 		if err != nil {
 			return errToStatus(err), err
@@ -24,7 +30,7 @@ var withHashFile = func(fn handleFunc) handleFunc {
 
 		file, err := files.NewFileInfo(files.FileOptions{
 			Fs:      d.user.Fs,
-			Path:    link.Path + path,
+			Path:    filepath.Join(link.Path, path),
 			Modify:  d.user.Perm.Modify,
 			Expand:  true,
 			Checker: d,
@@ -40,14 +46,18 @@ var withHashFile = func(fn handleFunc) handleFunc {
 
 // ref to https://github.com/filebrowser/filebrowser/pull/727
 // `/api/public/dl/MEEuZK-v/file-name.txt` for old browsers to save file with correct name
-func ifPathWithName(r *http.Request) (id, path string) {
+func ifPathWithName(r *http.Request) (id, rootName, path string) {
 	pathElements := strings.Split(r.URL.Path, "/")
 	// prevent maliciously constructed parameters like `/api/public/dl/XZzCDnK2_not_exists_hash_name`
 	// len(pathElements) will be 1, and golang will panic `runtime error: index out of range`
-	if len(pathElements) <= 2 { //nolint: mnd
-		return pathElements[0], ""
+	switch len(pathElements) {
+	case 1:
+		return r.URL.Path, "", ""
+	case 2:
+		return pathElements[0], pathElements[1], ""
+	default:
+		return pathElements[0], pathElements[1], strings.Join(pathElements[2:], "/")
 	}
-	return pathElements[0], strings.Join(pathElements[2:], "/")
 }
 
 var publicShareHandler = withHashFile(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {