AmendHub

--- folder.c Sat Dec 6 21:43:56 2025 +++ folder.c Tue Sep 22 15:08:46 2026 @@ -145,6 +145,10 @@ folder_list(struct session *s) session_flush(s); for (n = 0; n < db->nfolders; n++) { + if (db->folders[n].restricted_viewing && + !(s->user && s->user->is_sysop)) + continue; + session_printf(s, "%2d %- 13.13s %s\r\n", n + 1, db->folders[n].name, @@ -210,10 +214,18 @@ folder_show(struct session *s, struct folder *folder) show_help = false; done = false; + if (folder->restricted_viewing && !(s->user && s->user->is_sysop)) { + session_printf(s, "Invalid folder\r\n"); + session_flush(s); + return; + } + snprintf(prompt, sizeof(prompt), "Files:%s", folder->name); while (!done && !s->ending) { if (find_files) { + if (file_ids != NULL) + xfree(&file_ids); folder_find_file_ids(folder, &nfile_ids, &file_ids); fpp = FILES_PER_PAGE; if (s->terminal_lines < fpp + 3) @@ -265,12 +277,14 @@ handle_opt: show_list = true; break; case '#': - if (fn < 1 || fn > nfile_ids) { + if (fn < 1 || fn > fpp || + (fpp * page) + fn > nfile_ids) { session_printf(s, "Invalid file\r\n"); session_flush(s); break; } - c = folder_file_view(s, folder, file_ids[fn - 1]); + c = folder_file_view(s, folder, + file_ids[(fpp * page) + fn - 1]); if (c == FILE_VIEW_RETURN_FIND) find_files = true; break; @@ -356,6 +370,12 @@ folder_upload(struct session *s, struct folder *folder return 0; } + if (folder->restricted_posting && !s->user->is_sysop) { + session_printf(s, "Uploading to this folder is not permitted.\r\n"); + session_flush(s); + return 0; + } + if (initial_filename) strlcpy(file.filename, initial_filename, sizeof(file.filename)); @@ -821,11 +841,17 @@ folder_find_file_ids(struct folder *folder, size_t *nf for (n = 0; (o = bile_get_nth_of_type(folder->bile, n, FOLDER_FILE_RTYPE)); n++) { - if (n >= *nfile_ids) + if (n >= *nfile_ids) { + xfree(&o); break; + } if (bile_read_alloc(folder->bile, FOLDER_FILE_RTYPE, o->id, - &data) == 0) + &data) == 0) { + if (data != NULL) + xfree(&data); + xfree(&o); break; + } ret = bile_unmarshall_object(folder->bile, folder_file_object_fields, nfolder_file_object_fields, data, o->size, &file, sizeof(file), false);