fix: scope check when using the HTTP API to upload files closes #4312

tauri-apps · Jun 10, 2022 · 8ce5b76 · 8ce5b76
1 parent c2b7c77
commit 8ce5b76
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/.changes/fix-http-multipart-file-validation.md b/.changes/fix-http-multipart-file-validation.md
@@ -0,0 +1,5 @@
+---
+"tauri": patch
+---
+
+Fixes filesystem scope check when using the HTTP API to upload files.
diff --git a/core/tauri/src/endpoints/http.rs b/core/tauri/src/endpoints/http.rs
@@ -103,7 +103,7 @@ impl Cmd {
           } = value
           {
             if crate::api::file::SafePathBuf::new(path.clone()).is_err()
-              || scopes.fs.is_allowed(&path)
+              || !scopes.fs.is_allowed(&path)
             {
               return Err(crate::Error::PathNotAllowed(path.clone()).into_anyhow());
             }