Merge pull request #49179 from nextcloud/backport/49143/stable29

apps/files/src/actions/viewInFolderAction.spec.ts

@@ -126,6 +126,18 @@ describe('View in folder action enabled tests', () => {
 		expect(action.enabled).toBeDefined()
 		expect(action.enabled!([folder], view)).toBe(false)
 	})
+
+	test('Disabled for files outside the user root folder', () => {
+		const file = new Folder({
+			id: 1,
+			source: 'https://cloud.domain.com/remote.php/dav/trashbin/admin/trash/image.jpg.d1731053878',
+			owner: 'admin',
+			permissions: Permission.READ,
+		})
+
+		expect(action.enabled).toBeDefined()
+		expect(action.enabled!([file], view)).toBe(false)
+	})
 })
 
 describe('View in folder action execute tests', () => {

apps/files/src/actions/viewInFolderAction.ts

@@ -47,6 +47,11 @@ export const action = new FileAction({
 			return false
 		}
 
+		// Can only view files that are in the user root folder
+		if (!node.root?.startsWith('/files')) {
+			return false
+		}
+
 		if (node.permissions === Permission.NONE) {
 			return false
 		}