fix(rename): block rename for password-protected paths

Author: Sky_slience

server/handles/fsbatch.go

@@ -195,6 +195,9 @@ func FsBatchRename(c *gin.Context) {
 			common.ErrorResp(c, err, 400)
 			return
 		}
+		if !canRenamePath(c, filePath) {
+			return
+		}
 		if err := fs.Rename(c, filePath, renameObject.NewName); err != nil {
 			common.ErrorResp(c, err, 500)
 			return
@@ -261,6 +264,9 @@ func FsRegexRename(c *gin.Context) {
 				common.ErrorResp(c, err, 500)
 				return
 			}
+			if !canRenamePath(c, filePath) {
+				return
+			}
 			newFileName := srcRegexp.ReplaceAllString(file.GetName(), req.NewNameRegex)
 			if err := utils.ValidateNameComponent(newFileName); err != nil {
 				common.ErrorResp(c, err, 400)

server/handles/fsmanage.go

@@ -2,10 +2,11 @@ package handles
 
 import (
 	"fmt"
-	"github.com/alist-org/alist/v3/internal/task"
 	"io"
 	stdpath "path"
 
+	"github.com/alist-org/alist/v3/internal/task"
+
 	"github.com/alist-org/alist/v3/internal/errs"
 	"github.com/alist-org/alist/v3/internal/fs"
 	"github.com/alist-org/alist/v3/internal/model"
@@ -213,6 +214,22 @@ type RenameReq struct {
 	Overwrite bool   `json:"overwrite"`
 }
 
+func canRenamePath(c *gin.Context, reqPath string) bool {
+	meta, err := op.GetNearestMeta(reqPath)
+	if err != nil {
+		if !errors.Is(errors.Cause(err), errs.MetaNotFound) {
+			common.ErrorResp(c, err, 500, true)
+			return false
+		}
+		return true
+	}
+	if meta != nil && meta.Password != "" && common.IsApply(meta.Path, reqPath, meta.PSub) {
+		common.ErrorStrResp(c, "Path is password-protected and cannot be renamed.", 403)
+		return false
+	}
+	return true
+}
+
 func FsRename(c *gin.Context) {
 	var req RenameReq
 	if err := c.ShouldBind(&req); err != nil {
@@ -229,6 +246,9 @@ func FsRename(c *gin.Context) {
 		common.ErrorResp(c, errs.PermissionDenied, 403)
 		return
 	}
+	if !canRenamePath(c, reqPath) {
+		return
+	}
 	perm := common.MergeRolePermissions(user, reqPath)
 	if !common.HasPermission(perm, common.PermRename) {
 		common.ErrorResp(c, errs.PermissionDenied, 403)