security in path list

2026-06-19 15:31:22 +02:00
parent f3bf67a641
commit 377e602bd3
3 changed files with 72 additions and 20 deletions
@@ -1036,6 +1036,18 @@
              },
              "path": {
                "type": "string"
+              },
+              "root": {
+                "type": "string"
+              },
+              "allowed_roots": {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "fallback": {
+                "type": "boolean"
              }
            },
            "type": "object"
@@ -5685,7 +5697,8 @@
            "sessionCookie": []
          }
        ],
-        "summary": "Browse server directories"
+        "summary": "Browse allowed rTorrent directories",
+        "description": "Lists only the rTorrent home or default download directory tree. Requests outside these roots fall back to the default download directory."
      }
    },
    "/api/path/default": {