From 0a7d696a37fda513b34f125a6e2053b399695532 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Acid=20Chicken=20=28=E7=A1=AB=E9=85=B8=E9=B6=8F=29?=
 <root@acid-chicken.com>
Date: Tue, 26 Mar 2019 22:24:14 +0900
Subject: [PATCH] Fix #4576 (#4579)

* Update update.ts

* Update api.ts
---
 src/server/api/endpoints/drive/folders/update.ts |  4 +++-
 test/api.ts                                      | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/server/api/endpoints/drive/folders/update.ts b/src/server/api/endpoints/drive/folders/update.ts
index 1dc0e6387..a1ee2669f 100644
--- a/src/server/api/endpoints/drive/folders/update.ts
+++ b/src/server/api/endpoints/drive/folders/update.ts
@@ -83,7 +83,9 @@ export default define(meta, async (ps, user) => {
 	if (ps.name) folder.name = ps.name;
 
 	if (ps.parentId !== undefined) {
-		if (ps.parentId === null) {
+		if (ps.parentId.equals(folder._id)) {
+			throw new ApiError(meta.errors.recursiveNesting);
+		} else if (ps.parentId === null) {
 			folder.parentId = null;
 		} else {
 			// Get parent folder
diff --git a/test/api.ts b/test/api.ts
index 85f376793..cc4521d3d 100644
--- a/test/api.ts
+++ b/test/api.ts
@@ -1141,6 +1141,20 @@ describe('API', () => {
 			expect(res).have.status(400);
 		}));
 
+		it('フォルダが循環するような構造にできない(自身)', async(async () => {
+			const arisugawa = await signup({ username: 'arisugawa' });
+			const folderA = (await request('/drive/folders/create', {
+				name: 'test'
+			}, arisugawa)).body;
+
+			const res = await request('/drive/folders/update', {
+				folderId: folderA.id,
+				parentId: folderA.id
+			}, arisugawa);
+
+			expect(res).have.status(400);
+		}));
+
 		it('存在しない親フォルダを設定できない', async(async () => {
 			const alice = await signup({ username: 'alice' });
 			const folder = (await request('/drive/folders/create', {