fix(web): enforce media ACL on request path, not resolved symlink (#173)

GeiserX · web-flow · commit e96d6e27c48d · 2026-05-26T23:57:40.000+02:00
* fix(web): enforce media ACL on request path, not resolved symlink

When media files are sharded symlinks (pointing to _shared/XX/),
resolve() follows the symlink and the ACL tried to parse "_shared"
as a chat ID — always failing with 403 for restricted users.

Admin was unaffected because unrestricted users skip ACL entirely.

Fix: enforce ACL on the original request path which contains the
actual chat folder, not the resolved filesystem target.

* fix(web): fix bright blue safe-area on mobile Safari

Body had a blue gradient that showed through safe-area padding on
iOS. Moved gradient to login page only; app body uses slate-900
matching theme-color meta tag.
diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "telegram-archive"
-version = "7.11.1"
+version = "7.11.2"
 description = "Automated Telegram backup with Docker. Performs incremental backups of messages and media on a configurable schedule."
 readme = "README.md"
 requires-python = ">=3.14"
diff --git a/src/__init__.py b/src/__init__.py
@@ -2,4 +2,4 @@
 Telegram Backup Automation - Main Package
 """
 
-__version__ = "7.11.1"
+__version__ = "7.11.2"
diff --git a/src/web/main.py b/src/web/main.py
@@ -947,7 +947,9 @@ async def serve_media(path: str, download: int = Query(0), user: UserContext = D
     if not resolved.is_relative_to(_media_root):
         raise HTTPException(status_code=403, detail="Access denied")
 
-    _enforce_media_acl(str(resolved.relative_to(_media_root)), user)
+    # ACL uses the original request path (chat folder), not the resolved symlink
+    # target — symlinks into _shared/ don't carry chat folder context.
+    _enforce_media_acl(path, user)
 
     if not resolved.is_file():
         raise HTTPException(status_code=404, detail="File not found")
diff --git a/src/web/templates/index.html b/src/web/templates/index.html
@@ -268,10 +268,10 @@
     </script>
 </head>
 
-<body class="bg-gradient-to-br from-blue-600 via-blue-700 to-blue-800 text-white h-screen overflow-hidden">
+<body class="bg-slate-900 text-white h-screen overflow-hidden">
     <div id="app" class="w-full h-full">
         <!-- Login Page -->
-        <div v-if="!isAuthenticated" class="w-full h-full flex items-center justify-center">
+        <div v-if="!isAuthenticated" class="w-full h-full flex items-center justify-center bg-gradient-to-br from-blue-600 via-blue-700 to-blue-800">
             <div
                 class="bg-white/10 backdrop-blur-lg rounded-2xl shadow-2xl p-10 w-full max-w-md border border-white/20">
                 <!-- Telegram Logo -->
