tcjlj/MeBox
1
0
Fork 0
mirror of https://github.com/truewhile/MeBox.git synced 2026-10-11 15:56:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce user library ACL on mounted Emby libraries (#25)

Browse Source 
Mounted Emby libraries were always appended to web/Emby library lists and
detail/play routes without checking allowed_library_ids, so restricted
users could still see and open them. Filter remotes with the same
visibility policy as local libraries across list/detail/series/stream and
Emby Views/Items/search/playback, and label mounts in the admin ACL UI.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: truewhile <truewhile@users.noreply.github.com>
This commit is contained in:
truewhile
2026-09-03 10:39:44 +08:00
committed by GitHub
parent 9ab32c10ca
commit 2b99f5f108
10 changed files with 172 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/service/emby_compat.go
+6
View File
@@ -156,6 +156,9 @@ func (e *EmbyService) Items(ctx context.Context, p ItemsParams) (map[string]any,
if mount == nil || acct == nil {
return emptyItemsEnvelope(p.StartIndex), nil
}
if !EmbyMountLibraryAllowed(e.mediaVisibility(ctx, p.UserID), mount) {
return emptyItemsEnvelope(p.StartIndex), nil
}
out, err := e.remote.RemoteItems(ctx, mount, acct, p)
if err != nil {
return nil, err
@@ -275,6 +278,9 @@ func (e *EmbyService) aggregatedSearch(ctx context.Context, p ItemsParams) (map[
if !m.Enabled {
continue
}
if !EmbyMountLibraryAllowed(e.mediaVisibility(ctx, p.UserID), &m) {
continue
}
acct := e.remote.AccountByID(ctx, m.AccountID)
if acct == nil {
continue