feat: make public folders a config opt-in

HeyPuter · Aug 14, 2024 · 209555c · 209555c
1 parent 461ea3e
commit 209555c
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/backend/src/services/auth/ACLService.js b/src/backend/src/services/auth/ACLService.js
@@ -56,9 +56,11 @@ class ACLService extends BaseService {
         }
 
         // Hard rule: anyone and anything can read /user/public directories
-        const public_modes = ['read', 'list', 'see'];
-        if ( public_modes.includes(mode) ) {
-            if ( await fsNode.isPublic() ) return true;
+        if ( this.global_config.enable_public_folders ) {
+            const public_modes = ['read', 'list', 'see'];
+            if ( public_modes.includes(mode) ) {
+                if ( await fsNode.isPublic() ) return true;
+            }
         }
 
         // Access tokens only work if the authorizer has permission