Merge pull request #18627 from glassez/v4.5

Backport changes to v4.5.x branch

src/base/rss/rss_session.cpp

@@ -185,8 +185,11 @@ nonstd::expected<void, QString> Session::moveItem(Item *item, const QString &des
     if (!result)
         return result.get_unexpected();
 
-    auto srcFolder = static_cast<Folder *>(m_itemsByPath.value(Item::parentPath(item->path())));
     const auto destFolder = result.value();
+    if (static_cast<Item *>(destFolder) == item)
+        return nonstd::make_unexpected(tr("Couldn't move folder into itself."));
+
+    auto srcFolder = static_cast<Folder *>(m_itemsByPath.value(Item::parentPath(item->path())));
     if (srcFolder != destFolder)
     {
         srcFolder->removeItem(item);

src/gui/rss/feedlistwidget.cpp

@@ -105,7 +105,8 @@ FeedListWidget::FeedListWidget(QWidget *parent)
     m_rssToTreeItemMapping[RSS::Session::instance()->rootFolder()] = invisibleRootItem();
 
     m_unreadStickyItem = new FeedListItem(this);
-    m_unreadStickyItem->setData(0, Qt::UserRole, QVariant::fromValue(RSS::Session::instance()->rootFolder()));
+    m_unreadStickyItem->setData(0, Qt::UserRole, QVariant::fromValue(
+            reinterpret_cast<intptr_t>(RSS::Session::instance()->rootFolder())));
     m_unreadStickyItem->setText(0, tr("Unread  (%1)").arg(RSS::Session::instance()->rootFolder()->unreadCount()));
     m_unreadStickyItem->setData(0, Qt::DecorationRole, UIThemeManager::instance()->getIcon(u"mail-inbox"_qs));
     m_unreadStickyItem->setData(0, StickyItemTagRole, true);
@@ -211,9 +212,10 @@ QList<QTreeWidgetItem *> FeedListWidget::getAllOpenedFolders(QTreeWidgetItem *pa
 
 RSS::Item *FeedListWidget::getRSSItem(QTreeWidgetItem *item) const
 {
-    if (!item) return nullptr;
+    if (!item)
+        return nullptr;
 
-    return item->data(0, Qt::UserRole).value<RSS::Item *>();
+    return reinterpret_cast<RSS::Item *>(item->data(0, Qt::UserRole).value<intptr_t>());
 }
 
 QTreeWidgetItem *FeedListWidget::mapRSSItem(RSS::Item *rssItem) const
@@ -275,7 +277,7 @@ QTreeWidgetItem *FeedListWidget::createItem(RSS::Item *rssItem, QTreeWidgetItem
 {
     auto *item = new FeedListItem;
     item->setData(0, Qt::DisplayRole, u"%1  (%2)"_qs.arg(rssItem->name(), QString::number(rssItem->unreadCount())));
-    item->setData(0, Qt::UserRole, QVariant::fromValue(rssItem));
+    item->setData(0, Qt::UserRole, QVariant::fromValue(reinterpret_cast<intptr_t>(rssItem)));
     m_rssToTreeItemMapping[rssItem] = item;
 
     QIcon icon;

src/webui/api/torrentscontroller.cpp

@@ -1099,10 +1099,6 @@ void TorrentsController::setLocationAction()
     if (!Utils::Fs::mkpath(newLocation))
         throw APIError(APIErrorType::Conflict, tr("Cannot make save path"));
 
-    // check permissions
-    if (!Utils::Fs::isWritable(newLocation))
-        throw APIError(APIErrorType::AccessDenied, tr("Cannot write to directory"));
-
     applyToTorrents(hashes, [newLocation](BitTorrent::Torrent *const torrent)
     {
         LogMsg(tr("WebUI Set location: moving \"%1\", from \"%2\" to \"%3\"")

src/webui/webapplication.cpp

@@ -151,9 +151,14 @@ WebApplication::~WebApplication()
 
 void WebApplication::sendWebUIFile()
 {
-    const QStringList pathItems {request().path.split(u'/', Qt::SkipEmptyParts)};
+    if (request().path.contains(u'\\'))
-    if (pathItems.contains(u".") || pathItems.contains(u".."))
+        throw BadRequestHTTPError();
-        throw InternalServerErrorHTTPError();
+
+    if (const QList<QStringView> pathItems = QStringView(request().path).split(u'/', Qt::SkipEmptyParts)
+            ; pathItems.contains(u".") || pathItems.contains(u".."))
+    {
+        throw BadRequestHTTPError();
+    }
 
     const QString path = (request().path != u"/")
         ? request().path