From a45e66d43c7411c103fc7b15f36688d981b20645 Mon Sep 17 00:00:00 2001
From: Shadowghost <Ghost_of_Stone@web.de>
Date: Fri, 28 Aug 2026 11:01:43 +0200
Subject: Enforce permissions on similar items

---
 .../SimilarItems/SimilarItemsAccessFilter.cs       | 42 ++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 Emby.Server.Implementations/Library/SimilarItems/SimilarItemsAccessFilter.cs

(limited to 'Emby.Server.Implementations/Library/SimilarItems/SimilarItemsAccessFilter.cs')

diff --git a/Emby.Server.Implementations/Library/SimilarItems/SimilarItemsAccessFilter.cs b/Emby.Server.Implementations/Library/SimilarItems/SimilarItemsAccessFilter.cs
new file mode 100644
index 0000000000..75aea0eab6
--- /dev/null
+++ b/Emby.Server.Implementations/Library/SimilarItems/SimilarItemsAccessFilter.cs
@@ -0,0 +1,42 @@
+using Jellyfin.Data.Enums;
+using Jellyfin.Database.Implementations.Entities;
+using MediaBrowser.Controller.Entities;
+using MediaBrowser.Controller.Library;
+
+namespace Emby.Server.Implementations.Library.SimilarItems;
+
+/// <summary>
+/// Builds the access filter that decides which items a similar-items lookup may return for a user.
+/// </summary>
+internal static class SimilarItemsAccessFilter
+{
+    private static readonly BaseItemKind[] _itemByNameKinds =
+    [
+        BaseItemKind.Person,
+        BaseItemKind.Genre,
+        BaseItemKind.MusicGenre,
+        BaseItemKind.MusicArtist,
+        BaseItemKind.Studio
+    ];
+
+    /// <summary>
+    /// Builds an access filter carrying the user's library access and parental restrictions.
+    /// </summary>
+    /// <param name="user">The user the lookup runs for.</param>
+    /// <param name="libraryManager">The library manager.</param>
+    /// <returns>The access filter.</returns>
+    public static InternalItemsQuery Build(User user, ILibraryManager libraryManager)
+    {
+        // IncludeItemTypes is read only for the by-name exemption here; the caller applies this
+        // filter through ApplyAccessFiltering, which does not translate it into a type restriction.
+        var accessFilter = new InternalItemsQuery(user)
+        {
+            IncludeItemTypes = _itemByNameKinds
+        };
+
+        // ConfigureUserAccess populates TopParentIds for the libraries the user may open.
+        libraryManager.ConfigureUserAccess(accessFilter, user);
+
+        return accessFilter;
+    }
+}
-- 
cgit v1.2.3