Non-Admin user and db:system()//repopath

Hi,

this returns nothing (as non-admin), but I noticed you can still list any folders above.

In my case the empty string left to having a path with a single slash '/' which translated to the root of the drive that basex was installed. I got the complete contents of the drive with our query [1].

The way it is right now, I see no reason why db:system()//repopath returns nothing.

Regards, Max

Happened with BaseX: 8.4.4

[1] https://github.com/axxepta/project-argon/blob/develop/src/main/resources/api/list-repo.xq

Hi Max,

The functions of the File Module are now restricted to users with admin permissions.

As you can do virtually anything with XQuery, I’m pretty sure that there are a bunch of other functions and modules that should be restricted to admin users. Feel free to name them if you stumble upon some more.

Thanks Christian