From 4490f8cfe4d2f67858ae032e3e533fc214729c45 Mon Sep 17 00:00:00 2001 From: seteiro Date: Thu, 23 Jul 2026 20:08:59 +0800 Subject: [PATCH] fix(webui): allow media directory access when restrictToWorkspace is enabled Add get_media_dir() as an extra allowed root in file_preview path resolution so uploaded images and documents remain previewable even with workspace restrictions on. Closes #5028 --- nanobot/webui/file_preview.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nanobot/webui/file_preview.py b/nanobot/webui/file_preview.py index dac0d0e3..af141be1 100644 --- a/nanobot/webui/file_preview.py +++ b/nanobot/webui/file_preview.py @@ -7,6 +7,7 @@ from pathlib import Path from typing import Any from urllib.parse import unquote, urlparse +from nanobot.config.paths import get_media_dir from nanobot.security.workspace_access import WorkspaceScope from nanobot.security.workspace_policy import WorkspaceBoundaryError, resolve_allowed_path @@ -86,10 +87,12 @@ def _resolve_preview_path(raw_path: str | None, *, scope: WorkspaceScope) -> Pat raise WebUIFilePreviewError(400, "path is too long") try: + extra_roots = [get_media_dir()] if scope.restrict_to_workspace else None resolved = resolve_allowed_path( path, workspace=scope.project_path, allowed_root=scope.project_path if scope.restrict_to_workspace else None, + extra_allowed_roots=extra_roots, strict=True, ) except FileNotFoundError as e: