From f11ac5d3be646b08b815f9afc1fe16f6282a6083 Mon Sep 17 00:00:00 2001
From: imperosol <thgirod@hotmail.com>
Date: Mon, 26 Oct 2026 22:55:34 +0100
Subject: [PATCH 1/3] fix: arbitrary file suppression

---
 core/views/files.py | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/core/views/files.py b/core/views/files.py
index 8b7b4f42..a68f5963 100644
--- a/core/views/files.py
+++ b/core/views/files.py
@@ -269,7 +269,7 @@ class FileView(CanViewMixin, DetailView, FormMixin):
     form_class = AddFilesForm
 
     @staticmethod
-    def handle_clipboard(request, obj):
+    def handle_clipboard(request, obj: SithFile):
         """Handle the clipboard in the view.
 
         This method can fail, since it does not catch the exceptions coming from
@@ -283,10 +283,9 @@ class FileView(CanViewMixin, DetailView, FormMixin):
                  where you want to paste the clipboard
         """
         if "delete" in request.POST:
-            for f_id in request.POST.getlist("file_list"):
-                file = SithFile.objects.filter(id=f_id).first()
-                if file:
-                    file.delete()
+            file_ids = request.POST.getlist("file_list")
+            for file in obj.children.filter(id__in=file_ids):
+                file.delete()
         if "clear" in request.POST:
             request.session["clipboard"] = []
         if "cut" in request.POST:

From f5a5782bacbe66388d560c13b70480c4488310f1 Mon Sep 17 00:00:00 2001
From: imperosol <thgirod@hotmail.com>
Date: Mon, 26 Oct 2026 22:57:30 +0100
Subject: [PATCH 2/3] fix: privilege escalation for
 `DeleteAllForumUserMessagesView`

---
 rootplace/views.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/rootplace/views.py b/rootplace/views.py
index 930f3b45..c1f11c71 100644
--- a/rootplace/views.py
+++ b/rootplace/views.py
@@ -184,10 +184,9 @@ class DeleteAllForumUserMessagesView(FormView):
     form_class = SelectUserForm
 
     def dispatch(self, request, *args, **kwargs):
-        res = super().dispatch(request, *args, **kwargs)
-        if request.user.is_root:
-            return res
-        raise PermissionDenied
+        if not request.user.is_root:
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)
 
     def form_valid(self, form):
         self.user = form.cleaned_data["user"]

From 59cdebbf4f99a75007fc56e8109a297c10bfcf27 Mon Sep 17 00:00:00 2001
From: imperosol <thgirod@hotmail.com>
Date: Mon, 26 Oct 2026 23:18:41 +0100
Subject: [PATCH 3/3] fix: permission check on SithFile move

---
 core/views/files.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/core/views/files.py b/core/views/files.py
index a68f5963..c97b3427 100644
--- a/core/views/files.py
+++ b/core/views/files.py
@@ -21,7 +21,7 @@ from wsgiref.util import FileWrapper
 
 from django import forms
 from django.conf import settings
-from django.core.exceptions import PermissionDenied
+from django.core.exceptions import PermissionDenied, ValidationError
 from django.db.models import Exists, OuterRef
 from django.forms.models import modelform_factory
 from django.http import Http404, HttpRequest, HttpResponse
@@ -233,6 +233,12 @@ class FileEditPropForm(forms.ModelForm):
 
     recursive = forms.BooleanField(label=_("Apply rights recursively"), required=False)
 
+    def clean_parent(self):
+        parent = self.cleaned_data["parent"]
+        if not self.instance.owner.can_edit(parent):
+            raise ValidationError(_("You cannot move this file there"))
+        return parent
+
 
 class FileEditPropView(CanEditPropMixin, UpdateView):
     model = SithFile
@@ -253,10 +259,7 @@ class FileEditPropView(CanEditPropMixin, UpdateView):
         return ret
 
     def get_success_url(self):
-        return reverse(
-            "core:file_detail",
-            kwargs={"file_id": self.object.id},
-        )
+        return reverse("core:file_detail", kwargs={"file_id": self.object.id})
 
 
 class FileView(CanViewMixin, DetailView, FormMixin):