fix: validate gps-summary path against every library

The /photos/gps-summary handler validated the incoming path against
the primary library's root with new_file=false, which requires the
path to exist on disk. For a viewer opened on a file from a
non-primary library, tapping the GPS link produced activePath =
<folder from lib 2>, the primary-only check failed, and the server
400'd — so the map came up empty.

Validation here is purely a traversal guard (the DAO does a prefix
LIKE against rel_path), so we now accept the path as long as any
configured library can resolve it without escaping its root.

Also applies cargo fmt drift on files touched this session.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cameron
2026-04-18 16:38:28 -04:00
committed by cameron
parent 54a1df60b8
commit a0f3bfab5f
4 changed files with 55 additions and 59 deletions

View File

@@ -526,9 +526,7 @@ impl PreviewClipGenerator {
fn relativize(&self, video_path: &str) -> String {
for lib in &self.libraries {
if let Some(stripped) = video_path.strip_prefix(&lib.root_path) {
return stripped
.trim_start_matches(['/', '\\'])
.replace('\\', "/");
return stripped.trim_start_matches(['/', '\\']).replace('\\', "/");
}
}
video_path