From 5c81e934553fb545ca9c801ec6d1eaa9ec51c6ee Mon Sep 17 00:00:00 2001 From: Kroonk Date: Sun, 12 Apr 2026 20:47:24 +0200 Subject: [PATCH] Isolate client workspaces from root portfolio and restrict Admin view to root images --- backend/server.js | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/backend/server.js b/backend/server.js index 798ef5b..c5ee595 100644 --- a/backend/server.js +++ b/backend/server.js @@ -140,21 +140,15 @@ app.get('/images/fulls/', (req, res) => { const folders = listSubfolders(FULLS_DIR); - // Admin: Root + alle Ordner + // Admin: Nur Root-Bilder (damit die Startseite sauber bleibt) if (req.user.role === 'admin') { - const allImages = [...rootImages]; - folders.forEach(folder => { - listImagesInDir(path.join(FULLS_DIR, folder)).forEach(name => { - allImages.push({ name, type: 'file', folder }); - }); - }); - return res.json(allImages); + return res.json(rootImages); } - // User/Client: Root + zugewiesene Ordner + // User/Client: NUR zugewiesene Ordner (keine Root-Bilder untermischen) db.all('SELECT folder_name FROM user_folders WHERE user_id = ?', [req.user.id], (err, rows) => { const assignedFolders = err ? [] : rows.map(r => r.folder_name); - const result = [...rootImages]; + const result = []; assignedFolders.forEach(folder => { if (folders.includes(folder)) { listImagesInDir(path.join(FULLS_DIR, folder)).forEach(name => {