MrDiderot/Photography
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Isolate client workspaces from root portfolio and restrict Admin view to root images
Some checks failed
Build & Push Docker Image / build-and-push (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Kroonk
2026-04-12 20:47:24 +02:00
parent eaa5945611
commit 5c81e93455
1 changed files with 4 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
backend/server.js
View File

@@ -140,21 +140,15 @@ app.get('/images/fulls/', (req, res) => {
const folders = listSubfolders(FULLS_DIR);
// Admin: Root + alle Ordner
// Admin: Nur Root-Bilder (damit die Startseite sauber bleibt)
if (req.user.role === 'admin') {
const allImages = [...rootImages];
folders.forEach(folder => {
listImagesInDir(path.join(FULLS_DIR, folder)).forEach(name => {
allImages.push({ name, type: 'file', folder });
});
});
return res.json(allImages);
return res.json(rootImages);
}
// User/Client: Root + zugewiesene Ordner
// User/Client: NUR zugewiesene Ordner (keine Root-Bilder untermischen)
db.all('SELECT folder_name FROM user_folders WHERE user_id = ?', [req.user.id], (err, rows) => {
const assignedFolders = err ? [] : rows.map(r => r.folder_name);
const result = [...rootImages];
const result = [];
assignedFolders.forEach(folder => {
if (folders.includes(folder)) {
listImagesInDir(path.join(FULLS_DIR, folder)).forEach(name => {