From 7a365edc9122f6c79bb483eae86188175633c7c9 Mon Sep 17 00:00:00 2001
From: Gamosoft <gamosoft@users.noreply.github.com>
Date: Mon, 17 Nov 2025 09:26:15 +0100
Subject: [PATCH] fixed security issue with notes deletion (#19)

---
 backend/utils.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/backend/utils.py b/backend/utils.py
index aa361b7..93e9e38 100644
--- a/backend/utils.py
+++ b/backend/utils.py
@@ -132,6 +132,11 @@ def delete_folder(notes_dir: str, folder_path: str) -> bool:
     try:
         full_path = Path(notes_dir) / folder_path
         
+        # Security check: ensure the path is within notes_dir
+        if not validate_path_security(notes_dir, full_path):
+            print(f"Security: Path is outside notes directory: {full_path}")
+            return False
+        
         if not full_path.exists():
             print(f"Folder does not exist: {full_path}")
             return False