bring up to date with github

src/lib/files.ts

@@ -1,6 +1,7 @@
 import fs from 'fs'
 import path from 'path'
 import type { DirectoryListing, FileEntry, MediaType } from '@/types'
+import { resolveAndJail } from '@/lib/libraries'
 
 const HIDDEN_FILES = /^\./
 
@@ -27,9 +28,12 @@ export function scanDirectory(
   libraryId: string,
   subpath: string
 ): DirectoryListing {
-  const absPath = subpath
-    ? path.resolve(libraryRoot, subpath)
-    : libraryRoot
+  let absPath: string
+  try {
+    absPath = subpath ? resolveAndJail(libraryRoot, subpath) : libraryRoot
+  } catch {
+    return { path: subpath, entries: [] }
+  }
 
   let dirents: fs.Dirent[]
   try {