fix(file-manager): Use correct path in LOCATION action menu to avoid unexpected deletion of whole shares by mgutt · Pull Request #2804 · unraid/webgui

mgutt · 2026-10-30T14:31:39Z

Summary

Fixes the Delete / Copy / Move menu of the disk names in the LOCATION column of the File Manager. The menu did not act on the file or folder of its row but on the top-level folder of the share on that disk.

Report: https://product.unraid.net/p/file-manager-delete-from-a-disk-name-in-the-location-column-deletes-the-whole-share-folder-on-that-disk-not-the-selected-file

Problem

When a user share is browsed, a duplicate file is highlighted and lists several disks in the LOCATION column. Clicking a disk name and confirming Delete is the obvious way to remove one copy, but the dialog showed /mnt/disk2/<share> and the confirmed delete removed the whole share folder of that disk (find <path> -delete is recursive), not the file.

Cause: my_devs() in include/Browse.php built the path of the menu from the name of the share (/mnt/<disk>/<share>) for every row, at every depth. Other views were wrong as well:

View	Path of the menu before	Row
user share `/mnt/user/share/sub`	`/mnt/disk2/share`	`/mnt/user/share/sub/dup.txt`
exclusive share `/mnt/user/ssd/sub`	`/mnt/cache/ssd`	`/mnt/user/ssd/sub/dup.txt`
disk `/mnt/disk1/share/sub`	`/mnt/disk1/disk1` (does not exist)	`/mnt/disk1/share/sub/dup.txt`
flash drive `/boot/config/plugins`	`/boot/flash` (does not exist)	`/boot/config/plugins/a.plg`

For an exclusive share every row has exactly one location (the pool), so the delete in that menu removed the whole share.

This bug is present for years, so other similar reports of unexpected deletions (which we were not able to reproduce) could had the same cause.

Fix

The menu gets the path of the row:

user share (/mnt/user, /mnt/user0, exclusive share): the same path on the selected disk or pool, e.g. /mnt/user/share/dir/file -> /mnt/disk2/share/dir/file
disk and flash drive: the entry itself

Because the path is now a file name (it was a share name before), it is passed to the JavaScript function as a JSON string in an escaped HTML attribute. File names can contain quotes, backslashes, HTML characters or line breaks.

Testing

Test server (Unraid 7.3.4): a share with sub/dup.txt, other/keep.txt and unique.txt on two array disks and one in an exclusive share. Before: the menu of dup.txt on disk2 hands over /mnt/disk2/dfmtest, and the delete job removed the whole folder. After: /mnt/disk2/dfmtest/sub/dup.txt, and the delete job removes only this file.
Names with quotes, HTML characters (also entity-like names such as a<b), backslashes, line breaks and unicode reach the JavaScript function unchanged.

Summary by CodeRabbit

Bug Fixes
- Corrected how file and folder locations are handled in browsing action menus. Actions in user-share listings now use the displayed location, helping ensure they apply to the item shown. Other listings continue to use their displayed paths directly. This improves consistency when navigating directories and selecting items in the browser.

…OCATION menu The menu of a disk name in the LOCATION column was built from the name of the share only, so Delete, Copy and Move acted on /mnt/<disk>/<share> for a file or folder at any depth. Confirming "Delete" for a duplicate file on disk2 removed the whole share folder of disk2 (find -delete is recursive). For an exclusive share it was /mnt/<pool>/<share>, in the disk view /mnt/<disk>/<disk> and on the flash drive /boot/flash (paths which do not exist). The menu now gets the path of the row: in a user share the same path on the selected disk or pool (/mnt/user/share/dir/file -> /mnt/disk2/share/dir/file), everywhere else the entry itself. The path is now a file name and not a share name, so it is passed to JavaScript as a JSON string in an escaped HTML attribute (names can contain quotes, backslashes, HTML characters or line breaks).

coderabbitai · 2026-10-30T14:31:57Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: b9a0846d-f959-4165-82f3-ed3babb1a293

Commits

Reviewing files that changed from the base of the PR and between 9754759 and 38ebcfc.

Files selected for processing: 1

emhttp/plugins/dynamix/include/Browse.php

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The browse action-menu function now accepts a displayed path. For user-share listings, it builds the menu path under /mnt/$dev/; for other listings, it uses the displayed path. Directory and file listings pass the displayed item path.

Changes

Browse action-menu paths

Layer / File(s)	Summary
Build and pass displayed paths `emhttp/plugins/dynamix/include/Browse.php`	`my_devs` now accepts the displayed path and reads the global `$user` flag. For user-share listings, it builds a path under `/mnt/$dev/`; otherwise, it uses the displayed path. It JSON-encodes and HTML-escapes the handler argument. Directory and file listings now pass `$name` instead of `$dev_name`.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: elibosley

Merge Risk: Minimal · up to 38ebc

No actionable merge-blocking risk remains; the LOCATION actions use the selected row’s path.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title names the main change: the LOCATION action menu now uses the correct row path, which stops Delete, Copy, and Move from acting on the whole share. The summary confirms this change to my_devs …

Full details: Title check

Explanation

The title names the main change: the LOCATION action menu now uses the correct row path, which stops Delete, Copy, and Move from acting on the whole share. The summary confirms this change to my_devs in Browse.php, which now receives the displayed path and passes it through JSON encoding and HTML escaping. The title is specific and matches the objectives, which describe the same fix. It is 104 characters, which is longer than ideal but still readable.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the paths with care,
User shares lead to /mnt/ there.
Other paths keep their displayed shape,
Encoded safely for each menu escape.
The browse list sends the path along,
And hops away to browse its song.}

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-30T14:32:14Z

🔧 PR Test Plugin Available

A test plugin has been generated for this PR that includes the modified files.

Version: 2026.10.30.1431
Build: View Workflow Run

📥 Installation Instructions:

Install via Unraid Web UI:

Go to Plugins → Install Plugin
Copy and paste this URL:

https://preview.dl.unraid.net/pr-plugins/pr-2804/webgui-pr-2804.plg

Click Install

Alternative: Direct Download

⚠️ Important Notes:

Testing only: This plugin is for testing PR changes
Backup included: Original files are automatically backed up
Easy removal: Files are restored when plugin is removed
Conflicts: Remove this plugin before installing production updates
Post-merge behavior: This preview stays available after merge until preview storage expires or it is manually cleaned up

📝 Modified Files:

Click to expand file list

emhttp/plugins/dynamix/include/Browse.php

🔄 To Remove:

Navigate to Plugins → Installed Plugins and remove webgui-pr-2804, or run:

plugin remove webgui-pr-2804

_{🤖 This comment is automatically generated and will be updated with each new push to this PR.}

mgutt · 2026-10-30T14:54:24Z

Found an already existing PR covering this bugfix:
#2787

mgutt changed the title ~~fix(file-manager): act on the row and not on the whole share in the L…~~ fix(file-manager): fix LOCATION action menu path to avoid unexpected deletion of whole shares Oct 30, 2026

mgutt changed the title ~~fix(file-manager): fix LOCATION action menu path to avoid unexpected deletion of whole shares~~ fix(file-manager): Use correct path LOCATION action menu to avoid unexpected deletion of whole shares Oct 30, 2026

mgutt changed the title ~~fix(file-manager): Use correct path LOCATION action menu to avoid unexpected deletion of whole shares~~ fix(file-manager): Use correct path LOCATION in action menu to avoid unexpected deletion of whole shares Oct 30, 2026

mgutt changed the title ~~fix(file-manager): Use correct path LOCATION in action menu to avoid unexpected deletion of whole shares~~ fix(file-manager): Use correct path in LOCATION action menu to avoid unexpected deletion of whole shares Oct 30, 2026

mgutt closed this Oct 30, 2026

Navigation Menu

Repository navigation

fix(file-manager): Use correct path in LOCATION action menu to avoid unexpected deletion of whole shares - #2804

fix(file-manager): Use correct path in LOCATION action menu to avoid unexpected deletion of whole shares#2804
mgutt wants to merge 1 commit into
unraid:masterfrom
mgutt:fix-location-menu-path

mgutt commented Oct 30, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

mgutt commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

mgutt commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Fix

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Oct 30, 2026

🔧 PR Test Plugin Available

📥 Installation Instructions:

⚠️ Important Notes:

📝 Modified Files:

🔄 To Remove:

Uh oh!

mgutt commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mgutt commented Oct 30, 2026 •

edited

Loading

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading