From c83332e58cfd50c95fbb2c26c946628f28f3b4da Mon Sep 17 00:00:00 2001
From: Mark McDowall <mark@mcdowall.ca>
Date: Mon, 24 Mar 2025 20:14:55 -0700
Subject: [PATCH] New: Prevent Remote Path Mapping local folder being set to
 System folder or '/'

(cherry picked from commit 0f904e091702a2ac53771ee3aeb5aafe62688035)
---
 .../RemotePathMappingController.cs                | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/Lidarr.Api.V1/RemotePathMappings/RemotePathMappingController.cs b/src/Lidarr.Api.V1/RemotePathMappings/RemotePathMappingController.cs
index f0679e27b..33edddff3 100644
--- a/src/Lidarr.Api.V1/RemotePathMappings/RemotePathMappingController.cs
+++ b/src/Lidarr.Api.V1/RemotePathMappings/RemotePathMappingController.cs
@@ -28,10 +28,13 @@ namespace Lidarr.Api.V1.RemotePathMappings
                            .NotEmpty();
 
             SharedValidator.RuleFor(c => c.LocalPath)
-                           .Cascade(CascadeMode.Stop)
-                           .IsValidPath()
-                           .SetValidator(mappedNetworkDriveValidator)
-                           .SetValidator(pathExistsValidator);
+                .Cascade(CascadeMode.Stop)
+                .IsValidPath()
+                .SetValidator(mappedNetworkDriveValidator)
+                .SetValidator(pathExistsValidator)
+                .SetValidator(new SystemFolderValidator())
+                .NotEqual("/")
+                .WithMessage("Cannot be set to '/'");
         }
 
         public override RemotePathMappingResource GetResourceById(int id)
@@ -41,7 +44,7 @@ namespace Lidarr.Api.V1.RemotePathMappings
 
         [RestPostById]
         [Consumes("application/json")]
-        public ActionResult<RemotePathMappingResource> CreateMapping(RemotePathMappingResource resource)
+        public ActionResult<RemotePathMappingResource> CreateMapping([FromBody] RemotePathMappingResource resource)
         {
             var model = resource.ToModel();
 
@@ -62,7 +65,7 @@ namespace Lidarr.Api.V1.RemotePathMappings
         }
 
         [RestPutById]
-        public ActionResult<RemotePathMappingResource> UpdateMapping(RemotePathMappingResource resource)
+        public ActionResult<RemotePathMappingResource> UpdateMapping([FromBody] RemotePathMappingResource resource)
         {
             var mapping = resource.ToModel();