文件夹的密码限制可跳过

[wjy886]

Please make sure of the following things

• I have read the documentation.
  我已经阅读了文档。

• I'm sure there are no duplicate issues or discussions.
  我确定没有重复的issue或讨论。

• I'm sure it's due to AList and not something else(such as Network ,Dependencies or Operational).
  我确定是AList的问题，而不是其他原因（例如网络，依赖或操作）。

• I'm sure this issue is not fixed in the latest version.
  我确定这个问题在最新版本中没有被修复。

AList Version / AList 版本

v3.57.0

Driver used / 使用的存储驱动

本机存储

Describe the bug / 问题描述

如果给一个文件夹用元信息增加密码，这会使得其他人需要密码访问，但是如果这人有重命名的权限就可以修改这个文件夹的名字，从而跳过密码限制

Reproduction / 复现链接

同上

Config / 配置

{
"force": false,
"site_url": "",
"cdn": "",
"jwt_secret": "LHBhJTexERI3TSn7",
"token_expires_in": 48,
"database": {
"type": "sqlite3",
"host": "",
"port": 0,
"user": "",
"password": "",
"name": "",
"db_file": "data\data.db",
"table_prefix": "x_",
"ssl_mode": "",
"dsn": ""
},
"meilisearch": {
"host": "http://localhost:7700",
"api_key": "",
"index_prefix": ""
},
"scheme": {
"address": "0.0.0.0",
"http_port": 5244,
"https_port": -1,
"force_https": false,
"cert_file": "",
"key_file": "",
"unix_file": "",
"unix_file_perm": "",
"enable_h2c": false
},
"temp_dir": "data\temp",
"bleve_dir": "data\bleve",
"dist_dir": "",
"log": {
"enable": true,
"name": "data\log\log.log",
"max_size": 50,
"max_backups": 30,
"max_age": 28,
"compress": false
},
"delayed_start": 0,
"max_connections": 0,
"max_concurrency": 64,
"tls_insecure_skip_verify": false,
"tasks": {
"download": {
"workers": 5,
"max_retry": 1,
"task_persistant": false
},
"transfer": {
"workers": 5,
"max_retry": 2,
"task_persistant": false
},
"upload": {
"workers": 5,
"max_retry": 0,
"task_persistant": false
},
"copy": {
"workers": 5,
"max_retry": 2,
"task_persistant": false
},
"decompress": {
"workers": 5,
"max_retry": 2,
"task_persistant": false
},
"decompress_upload": {
"workers": 5,
"max_retry": 2,
"task_persistant": false
},
"s3_transition": {
"workers": 5,
"max_retry": 2,
"task_persistant": false
},
"allow_retry_canceled": false
},
"cors": {
"allow_origins": [
""
],
"allow_methods": [
""
],
"allow_headers": [
"*"
]
},
"s3": {
"enable": false,
"port": 5246,
"ssl": false
},
"ftp": {
"enable": false,
"listen": ":5221",
"find_pasv_port_attempts": 50,
"active_transfer_port_non_20": false,
"idle_timeout": 900,
"connection_timeout": 30,
"disable_active_mode": false,
"default_transfer_binary": false,
"enable_active_conn_ip_check": true,
"enable_pasv_conn_ip_check": true
},
"sftp": {
"enable": false,
"listen": ":5222"
},
"last_launched_version": "v3.57.0"
}

Logs / 日志

No response

[woshichenghaibo]

确实是个很大的漏洞

[skysliences]

问题已经收集，下个版本中进行修复

[skysliences]

#9434 已修复

[skysliences]

fixed