mirror of
https://github.com/projectsend/projectsend.git
synced 2026-10-03 21:03:17 +00:00
ignacionelson
48a1c9f227
Two edges of the staff folder screens, found while the folder API was built to answer the same questions. A client-scoped staff member can hold one of their clients' folders that sits inside somebody else's tree. The breadcrumb above it named every folder on the way up, including ones their library does not show them. It now starts at the first folder they can reach, as the client portal's already does (BreadcrumbBuilder::visible). Unscoped staff see the whole trail as before. Creating a folder did not ask Folder::uploadableBy for its parent, though every other write of a parent_id does: a folder inside a public one is public. Files were already refused there by the upload check, so what this closes is an empty folder's name appearing on a public page without upload_public. Staff holding upload_public, or creating inside a private folder, are unaffected.