1.0.37

src/routes/api/system/files/content/+server.ts

@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { readFileSync, existsSync, statSync } from 'node:fs';
 import { authorize } from '$lib/server/authorize';
+import { isProtectedPath } from '$lib/server/fs-guard';
 
 /**
  * GET /api/system/files/content
@@ -23,6 +24,10 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
 		return json({ error: 'Path is required' }, { status: 400 });
 	}
 
+	if (isProtectedPath(path)) {
+		return json({ error: 'Access denied' }, { status: 403 });
+	}
+
 	try {
 		if (!existsSync(path)) {
 			return json({ error: `File not found: ${path}` }, { status: 404 });