starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #1220] Restrict Library Paths #3487

New Issue
Open
opened 2026-04-25 00:15:51 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:15:51 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/1220
Author: @lkiesow
Created: 11/25/2022
Status: 🔄 Open

Base: master ← Head: media-base-path

📝 Commits (1)

📊 Changes

3 files changed (+18 additions, -7 deletions)

View changed files

📝 index.js (+2 -1)
📝 server/Server.js (+2 -1)
📝 server/controllers/LibraryController.js (+14 -5)

📄 Description

This patch introduces the new environment variable MEDIA_BASE_PATH allowing to restrict the media paths that can be added to libraries and therefore limiting which sections of the filesystem audiobookshelf will scan and potentially serve to the web.

This means, you can, for example, specify that all media are in /audiobooks, preventing users to access file system paths not starting with this.

This also prevents things like users specifying / as a library path which seems to be a good way for a denial of service attack right now.

The patch also adds the new environment variable to the example Docker commands and docker-compose files, matching the media file specified in those examples.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/1220 **Author:** [@lkiesow](https://github.com/lkiesow) **Created:** 11/25/2022 **Status:** 🔄 Open **Base:** `master` ← **Head:** `media-base-path` --- ### 📝 Commits (1) - [`4a12527`](https://github.com/advplyr/audiobookshelf/commit/4a125276b3ebfcf1bd216572db8e88e001c2e5bf) Restrict Library Paths ### 📊 Changes **3 files changed** (+18 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `index.js` (+2 -1) 📝 `server/Server.js` (+2 -1) 📝 `server/controllers/LibraryController.js` (+14 -5) </details> ### 📄 Description This patch introduces the new environment variable `MEDIA_BASE_PATH` allowing to restrict the media paths that can be added to libraries and therefore limiting which sections of the filesystem audiobookshelf will scan and potentially serve to the web. This means, you can, for example, specify that all media are in `/audiobooks`, preventing users to access file system paths not starting with this. This also prevents things like users specifying `/` as a library path which seems to be a good way for a denial of service attack right now. The patch also adds the new environment variable to the example Docker commands and docker-compose files, matching the media file specified in those examples. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:15:51 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3487
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?