From 9228ef53de765e9ade4c4d33222aa58f61fffa95 Mon Sep 17 00:00:00 2001 From: Markus Hilger Date: Sat, 15 Aug 2026 13:46:30 +0200 Subject: [PATCH] Ask for search access on a download directory too A directory the caller can write but not enter is one they could not have created the file in, and write access alone said they could. --- confluent_server/confluent/messages.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/confluent_server/confluent/messages.py b/confluent_server/confluent/messages.py index 1ed1c158..a65f0af1 100644 --- a/confluent_server/confluent/messages.py +++ b/confluent_server/confluent/messages.py @@ -681,8 +681,12 @@ class InputFirmwareUpdate(ConfluentMessage): # meaning here is whether the user could have # created the file there themselves. target = destdir(value) + # Search as well as write: a directory the user can + # write but not enter is one they cannot create a + # file in, and os.access says nothing about that on + # its own if not checkaccess(curruser, target, pwent, - os.W_OK): + os.W_OK | os.X_OK): raise Exception( '{0} is not writable by {1}, check the ' 'directory and parent directory ownership '