From cb95085ea315e5b49b3988776889bd95e5f19ada Mon Sep 17 00:00:00 2001
From: Bruno Bernardino <me@brunobernardino.com>
Date: Sun, 22 Jun 2025 11:19:02 +0100
Subject: [PATCH] Fix Windows clients sending the wrong path for public sharing

Fixes #73
---
 components/files/CreateShareModal.tsx |  4 ++--
 components/files/ManageShareModal.tsx |  6 +++---
 components/files/ShareVerifyForm.tsx  |  4 ++--
 routes/api/files/create-share.tsx     | 11 ++++++++++-
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/components/files/CreateShareModal.tsx b/components/files/CreateShareModal.tsx
index 87da611..50c6344 100644
--- a/components/files/CreateShareModal.tsx
+++ b/components/files/CreateShareModal.tsx
@@ -28,12 +28,12 @@ export default function CreateShareModal(
         <h1 class='text-2xl font-semibold my-5'>Create New Public Share Link</h1>
         <section class='py-5 my-2 border-y border-slate-500'>
           <fieldset class='block mb-2'>
-            <label class='text-slate-300 block pb-1' for='password'>Password</label>
+            <label class='text-slate-300 block pb-1' for='create-share-password'>Password</label>
             <input
               class='input-field'
               type='password'
               name='password'
-              id='password'
+              id='create-share-password'
               value={newPassword.value}
               onInput={(event) => {
                 newPassword.value = event.currentTarget.value;
diff --git a/components/files/ManageShareModal.tsx b/components/files/ManageShareModal.tsx
index aec1e3d..9ddab6e 100644
--- a/components/files/ManageShareModal.tsx
+++ b/components/files/ManageShareModal.tsx
@@ -73,14 +73,14 @@ export default function ManageShareModal(
             <code class='bg-slate-700 my-2 px-2 py-1 rounded-md'>{baseUrl}/file-share/{fileShareId}</code>
           </section>
           <fieldset class='block mb-2'>
-            <label class='text-slate-300 block pb-1' for='password'>
+            <label class='text-slate-300 block pb-1' for='manage-share-password'>
               {fileShare.value?.extra.hashed_password ? 'New Password' : 'Set Password'}
             </label>
             <input
               class='input-field'
               type='password'
-              name='password'
-              id='password'
+              name='manage-share-password'
+              id='manage-share-password'
               value={newPassword.value}
               onInput={(event) => {
                 newPassword.value = event.currentTarget.value;
diff --git a/components/files/ShareVerifyForm.tsx b/components/files/ShareVerifyForm.tsx
index 0ae5d82..f33c344 100644
--- a/components/files/ShareVerifyForm.tsx
+++ b/components/files/ShareVerifyForm.tsx
@@ -30,12 +30,12 @@ export default function ShareVerifyForm(
         method='POST'
       >
         <fieldset class='block mb-4'>
-          <label class='text-slate-300 block pb-1' for='token'>
+          <label class='text-slate-300 block pb-1' for='verify-password'>
             Password
           </label>
           <input
             type='password'
-            id='password'
+            id='verify-password'
             name='password'
             placeholder='Password'
             class='mt-1 input-field'
diff --git a/routes/api/files/create-share.tsx b/routes/api/files/create-share.tsx
index cc9a83a..1fb2535 100644
--- a/routes/api/files/create-share.tsx
+++ b/routes/api/files/create-share.tsx
@@ -37,7 +37,16 @@ export const handler: Handlers<Data, FreshContextState> = {
 
     if (
       !requestBody.filePath || !requestBody.pathInView || !requestBody.filePath.trim() ||
-      !requestBody.pathInView.trim() || !requestBody.filePath.startsWith('/') ||
+      !requestBody.pathInView.trim()
+    ) {
+      return new Response('Bad Request', { status: 400 });
+    }
+
+    // Fix Windows clients sending the directory path with backslashes
+    requestBody.filePath = requestBody.filePath.replace(/\\/g, '/');
+
+    if (
+      !requestBody.filePath.startsWith('/') ||
       requestBody.filePath.includes('../') || !requestBody.pathInView.startsWith('/') ||
       requestBody.pathInView.includes('../')
     ) {