fix: hide apply to sub path without enable (close #3661)

server/common/check.go

@@ -1,6 +1,7 @@
 package common
 
 import (
+	"path"
 	"regexp"
 	"strings"
 
@@ -15,9 +16,17 @@ func CanWrite(meta *model.Meta, path string) bool {
 	return meta.WSub || meta.Path == path
 }
 
+func IsApply(metaPath, reqPath string, applySub bool) bool {
+	if utils.PathEqual(metaPath, reqPath) {
+		return true
+	}
+	return utils.IsSubPath(reqPath, metaPath) && applySub
+}
+
 func CanAccess(user *model.User, meta *model.Meta, reqPath string, password string) bool {
 	// if the reqPath is in hide (only can check the nearest meta) and user can't see hides, can't access
-	if meta != nil && !user.CanSeeHides() && meta.Hide != "" && !utils.PathEqual(meta.Path, reqPath) {
+	if meta != nil && !user.CanSeeHides() && meta.Hide != "" &&
+		IsApply(meta.Path, path.Dir(reqPath), meta.HSub) { // the meta should apply to the parent of current path
 		for _, hide := range strings.Split(meta.Hide, "\n") {
 			re := regexp.MustCompile(hide)
 			if re.MatchString(reqPath[len(meta.Path)+1:]) {