From 04ac7fbd21741e5fb9dd8471e7b224630385aa1d Mon Sep 17 00:00:00 2001 From: ed Date: Mon, 1 Dec 2025 16:32:33 +0000 Subject: [PATCH] shares: remove delete-permission (closes #1023); until now, shares could be created with permissions read/write/delete (any combination thereof), however the delete option was never fully implemented and dysfunctional, hence now removed using vn0/rem0 throughout _handle_rm would almost be sufficient however the primary concern is ensuring integrity of metadata tables, and _forget_file expects a dbv rather than the share's vn --- copyparty/httpcli.py | 3 +++ copyparty/web/browser.js | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py index 86d224c8a..395e7254b 100644 --- a/copyparty/httpcli.py +++ b/copyparty/httpcli.py @@ -6231,6 +6231,9 @@ class HttpCli(object): self.log("unpost was denied" + BADXFF, 1) raise Pebkac(403, "the delete feature is disabled in server config") + if not unpost and self.vn.shr_src: + raise Pebkac(403, "files in shares can only be deleted with unpost") + if not req: req = [self.vpath] elif self.is_vproxied: diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js index a29016c34..093467afb 100644 --- a/copyparty/web/browser.js +++ b/copyparty/web/browser.js @@ -3825,7 +3825,7 @@ var fileman = (function () { 'perms', ]; for (var a = 0; a < perms.length; a++) - if (!has(['admin', 'move'], perms[a])) + if (!has(['admin', 'move', 'delete'], perms[a])) html.push('' + perms[a] + ''); if (has(perms, 'write'))