fix: scope file access restrictions and honor custom data directories

back/api/config.ts

@@ -4,7 +4,6 @@ import { Logger } from 'winston';
 import config from '../config';
 import * as fs from 'fs/promises';
 import { celebrate, Joi } from 'celebrate';
-import { join, basename } from 'path';
 import { SAMPLE_FILES } from '../config/const';
 import { t } from '../shared/i18n';
 import ConfigService from '../services/config';
@@ -74,15 +73,13 @@ export default (app: Router) => {
       try {
         const { name, content } = req.body;
         // Resolve path first to prevent traversal attacks
-        let basePath = config.configPath;
-        if (name.startsWith('data/scripts/')) {
-          basePath = join(config.rootPath, 'data/scripts');
-        }
+        const scriptFile = name.startsWith('data/scripts/');
+        const basePath = scriptFile ? config.scriptPath : config.configPath;
         const cleanName = name.replace(/^data\/scripts\//, '');
         const normalized = resolveFileAccess(
           basePath,
           [cleanName],
-          config.blackFileList,
+          scriptFile ? [] : config.blackFileList,
         );
         if (!normalized) {
           return res.send({ code: 403, message: t('文件无法访问') });

back/services/config.ts

@@ -19,7 +19,7 @@ export default class ConfigService {
     const resolved = resolveFileAccess(
       scriptFile ? config.scriptPath : config.configPath,
       [scriptFile ? filePath.slice('data/scripts/'.length) : filePath],
-      config.blackFileList,
+      scriptFile ? [] : config.blackFileList,
     );
     if (!resolved) {
       return res.send({ code: 403, message: t('文件无法访问') });

back/services/log.ts

@@ -1,5 +1,4 @@
 import { resolveFileAccess } from '../shared/fileAccess';
-import path from 'path';
 import { Inject, Service } from 'typedi';
 import winston from 'winston';
 import config from '../config';
@@ -9,10 +8,6 @@ export default class LogService {
   constructor(@Inject('logger') private logger: winston.Logger) {}
 
   public checkFilePath(filePath: string, fileName: string) {
-    return resolveFileAccess(
-      config.logPath,
-      [filePath || '', fileName],
-      config.blackFileList,
-    );
+    return resolveFileAccess(config.logPath, [filePath || '', fileName]);
   }
 }