mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-20 15:22:59 +00:00
Anso
3e2f0450c2
The Files & Volumes explorer derives its browsable roots from a stack's declared bind mounts. A bind whose source resolves inside Sencho's own application root (the working directory the image runs from, holding the compiled dist/, the served public/, and node_modules) was classified accessible, browsable, and writable. A non-admin with stack edit rights could therefore declare a bind such as /app/dist into a stack and gain read/write access to Sencho's program files. The bind-root classifier now treats the application root as a managed area, the same way it already treats the compose base and the data directory, so a bind that overlaps it is non-browsable and non-writable and the file routes reject read and write operations against it. The check is gated on the bind not being inside the current stack directory, so a legitimate stack-scoped bind under the compose base (which can sit under the application root) stays browsable. The application root is resolved dynamically from the process working directory, mirroring how the data directory is resolved, rather than hardcoding a path.