Update each uer will have specific folder #64
Conversation
phattantran1997
commented
Apr 27, 2025
- Each user now has a personal download folder based on their user ID.
- Updated FileManager to dynamically use user-specific root paths instead of global /downloads
There was a problem hiding this comment.
Hello @phattantran1997, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
Summary of Changes
This pull request implements user-specific download folders. It modifies the DownloadFromDirectLink.razor and DownloadVideoAudio.razor components to use a user ID to create a unique download path. The FileManager.razor component is updated to reflect these changes, and a ValidateUserDownloadFolder method is added to ensure that users can only access their own download folders. The DirectoryBrowser.cs file is updated to include a method for getting the user specific download path.
Highlights
- User-Specific Download Folders: Each user now has a personal download folder based on their user ID, enhancing privacy and organization.
- Dynamic Root Paths: The
FileManagercomponent dynamically uses user-specific root paths instead of a global/downloadsdirectory. - Path Validation: A
ValidateUserDownloadFoldermethod is implemented to prevent users from accessing download folders outside of their designated directory.
Changelog
Click here to see the changelog
- SaveHere/SaveHere/Components/Download/DownloadFromDirectLink.razor
- Added
@using System.Security.Claimsto access user claims. - Injected
AuthenticationStateProviderto get user authentication state. - Passed
UserIdanduserFolderPathparameters to theFileManagercomponent. - Initialized
userIdanduserFolderPathbased on the authenticated user inOnInitializedAsync(lines 279-282). - Added
ValidateUserDownloadFoldermethod to validate the download folder path (lines 675-686). - Modified the
DownloadFolderproperty ofFileDownloadQueueItemto use the validated folder path inAddDownloadItemandStartDownloadItemmethods (lines 495-496, 525-526).
- Added
- SaveHere/SaveHere/Components/Download/DownloadVideoAudio.razor
- Added
@using SaveHere.Helpersand@using System.Security.Claims. - Injected
AuthenticationStateProvider. - Passed
UserIdandCurrentPathparameters to theFileManagercomponent. - Initialized
userIdanduserFolderPathbased on the authenticated user inOnInitializedAsync(lines 251-254). - Added
ValidateUserDownloadFoldermethod to validate the download folder path (lines 583-594). - Modified the
DownloadFolderproperty ofYoutubeDownloadQueueItemto use the validated folder path inAddDownloadItemandStartDownloadItemmethods (lines 404-405, 428).
- Added
- SaveHere/SaveHere/Components/Utility/FileManager.razor
- Added
UserIdparameter. - Modified
_currentDirectoryto be an empty string initially. - Initialized
_userRootPathand_currentDirectorybased onUserIdinOnInitializedAsync(lines 172-173). - Updated
UpdateBreadcrumbsto use_userRootPathinstead ofDirectoryBrowser.DownloadsPath(lines 211-214). - Updated
NavigateToDirectoryto use_userRootPathwhen the path is null (line 226).
- Added
- SaveHere/SaveHere/Helpers/DirectoryBrowser.cs
- Added
GetUserDownloadsPathmethod to create and retrieve the user-specific downloads path (lines 168-183).
- Added
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
A user's space,
A folder of their own files,
Privacy ensured.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request introduces user-specific download folders, enhancing the application's file management capabilities. The changes involve updating the FileManager component and related services to dynamically use user-specific root paths instead of a global /downloads directory. This is a good step towards better user data isolation and organization.
Summary of Findings
- Potential Security Vulnerability in Folder Validation: The
ValidateUserDownloadFoldermethod inDownloadFromDirectLink.razorandDownloadVideoAudio.razorattempts to prevent path traversal vulnerabilities. However, the validation logic might be bypassed if theuserFolderPathcontains special characters or symbolic links. This could allow users to access directories outside their intended download folder. - Redundant Folder Validation: The
ValidateUserDownloadFoldermethod is called multiple times before starting a download, which could lead to performance overhead. Consider validating the folder once and reusing the validated path. - Inconsistent Error Handling: The
FileManagercomponent displays an error message if theUserIdparameter is null or empty. However, theDirectoryBrowser.GetUserDownloadsPathmethod throws anArgumentExceptionif theuserIdis null or empty. This inconsistency could lead to unexpected behavior.
Merge Readiness
The pull request introduces important changes for user-specific download folders. However, there are potential security vulnerabilities and inconsistencies in error handling that need to be addressed before merging. I recommend addressing the issues raised in the review comments before merging. I am unable to directly approve this pull request, and recommend that others review and approve this code before merging.
| if (string.IsNullOrEmpty(UserId)) | ||
| { | ||
| _currentDirectory = CurrentPath; | ||
| errorMessage = "User ID is required."; | ||
| return; |
There was a problem hiding this comment.
The FileManager component displays an error message if the UserId parameter is null or empty. However, the DirectoryBrowser.GetUserDownloadsPath method throws an ArgumentException if the userId is null or empty. Consider throwing an exception here as well to maintain consistency.
if (string.IsNullOrEmpty(UserId))
{
throw new ArgumentException("User ID cannot be null or empty.", nameof(UserId));
}
|
@gudarzi, hi, I have already created a new PR. Can you help check it? Thank you so much.ch. |