moveTorrents: get sourceBasePath and baseFileName in server

With these two properties, it is hard for third party to utilize API
to move torrents without retrieving torrent details first.

Plus, client-supplied paths and filenames can lead to arbitrary file
system access which is a security issue.

In conclusion, it doesn't make sense to let client to provide these
two properties.
This commit is contained in:
Jesse Chan
2020-09-29 17:32:11 +08:00
parent 912c66d497
commit f5f8952df9
5 changed files with 19 additions and 30 deletions
-5
View File
@@ -23,17 +23,12 @@ export interface DeleteTorrentsOptions {
deleteData?: boolean;
}
// TODO: filenames and sourcePaths should not be supplied by the client.
// POST /api/client/torrents/move
export interface MoveTorrentsOptions {
// Hashes of torrents to be moved
hashes: Array<TorrentProperties['hash']>;
// Path of destination
destination: string;
// Filenames of data of torrents
filenames: Array<string>;
// Source paths of data of torrents
sourcePaths: Array<string>;
// Whether to move data of torrents
moveFiles: boolean;
// Whether destination is the base path