Skip to content

fix(web): exclude sub-folder videos from public space root#1935

Merged
richiemcilroy merged 1 commit into
mainfrom
security/public-collection-subfolder-leak
Jun 19, 2026
Merged

fix(web): exclude sub-folder videos from public space root#1935
richiemcilroy merged 1 commit into
mainfrom
security/public-collection-subfolder-leak

Conversation

@richiemcilroy

@richiemcilroy richiemcilroy commented Jun 19, 2026

Copy link
Copy Markdown
Member

Excludes videos placed inside sub-folders from the public space root listing, so they are not surfaced before the sub-folder itself is made public.

Greptile Summary

This PR adds a single isNull(spaceVideos.folderId) predicate to the getPublicSpaceVideos query, preventing videos that live inside sub-folders from surfacing in the public space root listing before their parent folder is made public.

  • The fix is applied to the shared where variable used by both the paginated video list query and the total-count query, keeping them consistent.
  • No other root-listing code paths (getPublicOrgFolderVideos, getPublicSpaceFolderVideos, getPublicUserFolderVideos) are affected, as those are all folder-scoped queries and already filter by a specific folderId.

Confidence Score: 5/5

Safe to merge — the change is a single-predicate addition to an existing WHERE clause with no side effects on other query paths.

The fix is narrow and self-contained: one null-check predicate added to a shared where variable that both the video list and count queries already use, so pagination totals stay in sync with the filtered results. The other folder-scoped functions are unaffected. No logic regressions are apparent.

No files require special attention.

Important Files Changed

Filename Overview
apps/web/lib/public-collections.ts Adds isNull(spaceVideos.folderId) to the WHERE clause in getPublicSpaceVideos so sub-folder videos are excluded from the space root listing; the fix is applied to the shared where variable, so both the paginated query and the total-count query benefit consistently.

Reviews (2): Last reviewed commit: "fix(web): exclude sub-folder videos from..." | Re-trigger Greptile

@superagent-security

Copy link
Copy Markdown

Superagent didn't find any vulnerabilities or security issues in this PR.

@polarityinc

polarityinc Bot commented Jun 19, 2026

Copy link
Copy Markdown

Paragon Review Skipped

Hi @richiemcilroy! Your Polarity credit balance is insufficient to complete this review.

Please visit https://app.paragon.run to finish your review.

const offset = (page - 1) * PUBLIC_COLLECTION_PAGE_SIZE;
const where = and(
eq(spaceVideos.spaceId, collection.id as Space.SpaceIdOrOrganisationId),
isNull(spaceVideos.folderId),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does spaceVideos.folderId reliably stay NULL for root-level space videos? If there’s a “root folder” record now or in the future, this could unintentionally hide all videos from the root listing. Might be worth a quick regression test covering root vs sub-folder visibility.

@richiemcilroy

Copy link
Copy Markdown
Member Author

@greptileai please review the PR

@richiemcilroy richiemcilroy merged commit 6a08874 into main Jun 19, 2026
20 of 21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant