Friday, April 11, 2025
1 change · 18.0
Security fixes and vulnerability patches
Users opening a shortcut to a Documents folder will no longer see upload or request actions when they only have view access to the original folder. This prevents unintended changes through shortcuts and keeps folder permissions consistent.
Original PR description
Bug === 1. Create a folder, and change 'access_internal = view' (so Demo can view it, but not edit it) 2. Login as Demo 3. Create a shortcut to that folder 4. Click on the shortcut in the sidebar 5. You can upload in the shortcut even if you have no access on the target Now, the "Upload", "Request", etc buttons will be disabled if the user has no edit access on the target. Task-4626766