Lack of dir permission checks during move operations

[GitHubGeek]

Type: Bug Report

• Try to follow the update procedure described in the README and try again before opening this issue.

Your Environment

• Version used:
  • Version 4.7.0 stable release
• Environment name and version:
  • Node.js version 16.13.2
  • npm version 8.1.2
  • Web browser ffox
• Operating system and version: Debian 10
• Torrent client and version: rTorrent 0.9.7

Summary

The torrent data files are located in a read-only directory to the Flood user. When attempting to move said torrent to a different directory using Flood, there seems to be no permission checks before the move operation.

Expected Behavior

Flood displays an error message saying the data files cannot be moved

Current Behavior

Flood goes ahead with the move operation anyway; Data files remained in the original directory, and the torrent points to a non existence destination directory.

Possible Solution

Flood should check for write permission on both src and dest directories before the move operation. Print error and abort if permission is missing.

Steps to Reproduce

1. Using rTorrent, download a multi-files torrent my_torrent into directory /download, assuming the /download directory is world readable (0755), and is owned by the rTorrent / Flood user
2. Complete download, then change the ownership of my_torrent to someone else by running chown -R foo /download/my_torrent - Now my_torrent remains world readable but no longer writable by the rTorrent / Flood user
3. In Flood, use Set Location... to move the torrent to another directory
4. Torrent's location gets updated, but rTorrent cannot find the data anymore - remains in /download

[TPXP]

We could ask the torrent server to move the files for us by running a mv shell command. For rtorrent, this can probably be achieved with an execute call.