From 967d5deeb79405ce7122c6124dac019b278ca70b Mon Sep 17 00:00:00 2001
From: Felix Ruhnow <fruhnow@outlook.com>
Date: Mon, 18 Feb 2019 18:29:58 +0100
Subject: [PATCH] checking user-permission in GetQueryResult to prevent
 accessing the library without permission but having a link. (+added myself as
 contributor. forgot last time bout that)

---
 CONTRIBUTORS.md                              |  1 +
 MediaBrowser.Api/UserLibrary/ItemsService.cs | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index 28690f36fa..39149910c5 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -19,6 +19,7 @@
  - [LogicalPhallacy](https://github.com/LogicalPhallacy/)
  - [RazeLighter777](https://github.com/RazeLighter777)
  - [WillWill56](https://github.com/WillWill56)
+ - [fruhnow](https://github.com/fruhnow)
 
 # Emby Contributors
 
diff --git a/MediaBrowser.Api/UserLibrary/ItemsService.cs b/MediaBrowser.Api/UserLibrary/ItemsService.cs
index 3ae7da0073..895c88dc80 100644
--- a/MediaBrowser.Api/UserLibrary/ItemsService.cs
+++ b/MediaBrowser.Api/UserLibrary/ItemsService.cs
@@ -12,6 +12,7 @@ using MediaBrowser.Model.Entities;
 using MediaBrowser.Model.Globalization;
 using MediaBrowser.Model.Querying;
 using MediaBrowser.Model.Services;
+using Microsoft.Extensions.Logging;
 
 namespace MediaBrowser.Api.UserLibrary
 {
@@ -227,6 +228,16 @@ namespace MediaBrowser.Api.UserLibrary
                 request.IncludeItemTypes = "Playlist";
             }
 
+            if (!user.Policy.EnabledFolders.Where(i => new Guid(i).Equals(item.Id)).Any() && !user.Policy.EnableAllFolders)
+            {
+                Logger.LogWarning($"{user.Name} is not permitted to access Library {item.Name}.");
+                return new QueryResult<BaseItem>
+                {
+                    Items = new BaseItem[0],
+                    TotalRecordCount = 0
+                };
+            }
+
             if (request.Recursive || !string.IsNullOrEmpty(request.Ids) || user == null)
             {
                 return folder.GetItems(GetItemsQuery(request, dtoOptions, user));