From 3a1850715894011dc78bee38b825164b0fdd5d15 Mon Sep 17 00:00:00 2001
From: Edouard Vanbelle <opensource@edouard.vanbelle.fr>
Date: Mon, 11 May 2026 23:00:55 +0200
Subject: [PATCH] fix/security: copy_file_owned(): ensure that target is also
 owned by the user

---
 src/application/services/file_management_service.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/application/services/file_management_service.rs b/src/application/services/file_management_service.rs
index c5ee2ba8..eb7a3d37 100644
--- a/src/application/services/file_management_service.rs
+++ b/src/application/services/file_management_service.rs
@@ -186,6 +186,8 @@ impl FileManagementUseCase for FileManagementService {
         target_folder_id: Option<String>,
     ) -> Result<FileDto, DomainError> {
         self.verify_owner(file_id, caller_id).await?;
+        self.verify_target_folder_owner(&target_folder_id, caller_id)
+            .await?;
         self.copy_file(file_id, target_folder_id).await
     }