@trops/dash-core 0.1.804 → 0.1.806

package/dist/electron/index.js

@@ -16097,6 +16097,24 @@ var schedulerController_1 = schedulerController$2;
 	  return base;
 	}
 
+	// True only for a path strictly inside the widgets folder, links resolved,
+	// so a widget loaded from the user's folder (or a link to it) is never
+	// deleted with it.
+	function isInsideWidgetsDir(target) {
+	  try {
+	    const root = fs.realpathSync(WIDGETS_CACHE_DIR);
+	    const rel = path.relative(root, fs.realpathSync(target));
+	    return (
+	      rel !== "" &&
+	      rel !== ".." &&
+	      !rel.startsWith(`..${path.sep}`) &&
+	      !path.isAbsolute(rel)
+	    );
+	  } catch {
+	    return false;
+	  }
+	}
+
 	class WidgetRegistry {
 	  constructor(componentManager = null, customPath = null) {
 	    if (!WIDGETS_CACHE_DIR) {
@@ -17241,7 +17259,9 @@ var schedulerController_1 = schedulerController$2;
 	    }
 
 	    try {
-	      if (fs.existsSync(widget.path)) {
+	      // A folder of widgets loads in place, so its path is the user's own
+	      // folder: forget the widget, never delete files outside Dash's own.
+	      if (fs.existsSync(widget.path) && isInsideWidgetsDir(widget.path)) {
 	        fs.rmSync(widget.path, { recursive: true });
 	      }
 
@@ -17843,7 +17863,8 @@ var schedulerController_1 = schedulerController$2;
 	module.exports.setupWidgetRegistryHandlers = setupWidgetRegistryHandlers;
 	module.exports.validateZipEntries = validateZipEntries;
 	module.exports.setInstallGate = setInstallGate;
-	module.exports.checkPackage = checkPackage; 
+	module.exports.checkPackage = checkPackage;
+	module.exports.isInsideWidgetsDir = isInsideWidgetsDir; 
 } (widgetRegistry$1));
 
 var widgetRegistryExports = widgetRegistry$1.exports;