Horizontal42 c3bc67bd5b gate every dir-taking IPC command against a Rust-owned trust anchor ... load_documents, save_documents, run_backups, backup_deleted_sheet, open_backups_folder and data_dir_has_documents all took a `dir` param straight from the frontend and used it unchecked — any IPC caller (a buggy extension, compromised webview content) could point Rust at an arbitrary path, and migrate_data_dir's old_dir was the worst of it: combined with strategy="move" it deletes documents.json and everything under backups/ at whatever path it's handed. Add DataDirGate: a path only counts as authorized if it was proven user-chosen, either just now via the native folder picker or because it's the data-dir.txt this file itself wrote after a previous successful commit. save_file/load_file refuse to touch that filename so the frontend can't forge its own authorization. docs_dir() now returns Result and every command above goes through it. migrate_data_dir authorizes the target before copying but only writes data-dir.txt once every file has actually landed, so a migration that dies partway leaves the app still pointing at a folder that works.		2026-08-12 20:00:00 +03:00
..
main.rs	gate every dir-taking IPC command against a Rust-owned trust anchor	2026-08-12 20:00:00 +03:00