mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-29 02:32:01 +01:00
BooksandGitHub
7198a94164
doc_open, doc_save and the other automation file paths only took forward-slash relative paths, so an agent passing C:/Users/me/a.png with a C:/ root was refused. An absolute path is now compared with the root's absolute path as text: if it lies beneath the root, the root's components are stripped and the rest goes through the same checks as a relative path and is opened through the same directory capability. Nothing is resolved on the filesystem, so traversal, prefixes, device names and link escapes are refused as before; absolute paths outside the root, or with no root granted, are still refused. Fixes #2176.