fix: android: replace all-files access with scoped storage (#15602)

* fix: android: replace all-files access with scoped storage + system picker Remove MANAGE_EXTERNAL_STORAGE, READ_EXTERNAL_STORAGE, and WRITE_EXTERNAL_STORAGE from the Android manifest. Remove requestLegacyExternalStorage. Replace broad external storage with app-scoped external storage for the file-transfer workspace. File import uses the system file_picker. File export uses Android's SAF ACTION_CREATE_DOCUMENT with path validation that restricts export sources to app-owned directories. Remove the external_path dependency. Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: android: refine file import feedback Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: android: use SAF for file imports Replace file_picker imports with Android's Storage Access Framework to avoid legacy storage permissions, stale cached files, and duplicate staging of large imports. Stream selected documents into app-scoped storage with failure-safe replacement, keep exports restricted to validated app storage roots, use filesDir for the internal fallback workspace, and remove legacy permissions contributed during manifest merging. Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: android: keep file imports in the selected directory Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: android: reset projection and constrain file workspace Release capture resources when media projection is revoked externally. Keep Android local file navigation within the app-scoped workspace. Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: android: handle scoped storage start-up regressions. Allow zero digits in POSIX filenames by rejecting NUL explicitly, and initialise the app-specific home directory before the Android service starts the native server. Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: update content resolver mode to use 'wt' instead of 'w' to prevent trailing bytes from old document whilst reporting sucess Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: android, enforce file workspace boundary on the server, and unblock the ui thread. Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: android: validate rename destinations against the app workspace bound file-operation paths. report rename failures, general import failures, and unregister / reregister projection when its onStop callback fires. Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: reconnect was refreshing the directory with net entry instances, while selected items retained the old instances, it was reporting a selected item, but checkbox statue used object identity, and appeared unchecked. Fixed by reconciling by path and entry type before replacing the directory snapshot, rebinding valid selections, and dropping missing ones. Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix: (android) add SAF folder import and multi item export - import directories using ACTION_OPEN_DOCUMENT_TREE. Export multiple files, logs, and screen recordings via export buttons, add localisation keys for new actions Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> * fix(android): harden scoped storage file handling - create new SAF documents instead of overwriting export sources - reject empty peer paths except for home directory reads - report directory backup restore and cleanup failures - resolve log export paths from the configured app name Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): harden scoped-storage file operations - snapshot directory exports before writing to the destination - query document provider metadata off the main thread - reject invalid remote directories without read timeouts Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): handle SAF directory name collisions - reject dot-segment folder names during import - fail imports with duplicate document display names - only reuse matching directories during export Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): handle SAF folder import collisions Reject filesystem-equivalent destination names and avoid showing a failure when folder overwrite is skipped. Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: michaeljclarkk <104532890+michaeljclarkk@users.noreply.github.com> Signed-off-by: fufesou <linlong1266@gmail.com> Co-authored-by: fufesou <linlong1266@gmail.com>
2026-09-08 13:31:03 +03:00 · 2026-08-31 18:29:51 +10:00
parent 03a7fc5992
commit d4b06a6c5c
70 changed files with 1304 additions and 71 deletions
--- a/src/common.rs
+++ b/src/common.rs
@@ -222,6 +222,61 @@ pub fn need_fs_cm_send_files() -> bool {
    }
 }

+/// Android is scoped-storage only: the peer may never touch anything outside the app
+/// workspace (`Config::get_home()`, i.e. the app-specific external files directory).
+///
+/// Every peer supplied path must be validated with this before it reaches the
+/// filesystem, for reads, writes, renames, creations and deletions alike. The path is
+/// resolved to its canonical form (of the deepest existing ancestor, so paths that are
+/// about to be created are handled too) so symlinks cannot escape the workspace.
+///
+/// Only the `ReadDir` protocol action treats an empty path as the home directory.
+/// Callers must opt in to that protocol-specific behavior with `allow_empty`.
+#[cfg(target_os = "android")]
+pub fn is_peer_path_allowed(path: &str, allow_empty: bool) -> bool {
+    use std::path::{Component, Path, PathBuf};
+
+    // Canonicalize the deepest existing ancestor and re-append the missing tail.
+    fn resolve(path: &Path) -> Option<PathBuf> {
+        let mut tail: Vec<std::ffi::OsString> = Vec::new();
+        let mut base = path.to_path_buf();
+        loop {
+            if let Ok(mut resolved) = base.canonicalize() {
+                while let Some(component) = tail.pop() {
+                    resolved.push(component);
+                }
+                return Some(resolved);
+            }
+            tail.push(base.file_name()?.to_os_string());
+            if !base.pop() {
+                return None;
+            }
+        }
+    }
+
+    if path.is_empty() {
+        return allow_empty;
+    }
+    let path = Path::new(path);
+    // `..` is never needed by the protocol and would defeat the prefix check below.
+    if !path.is_absolute() || path.components().any(|c| c == Component::ParentDir) {
+        return false;
+    }
+    let home = Config::get_home();
+    let home = home.canonicalize().unwrap_or(home);
+    if home.as_os_str().is_empty() {
+        return false;
+    }
+    // `Path::starts_with` compares whole components, and is true for equal paths.
+    resolve(path).map_or(false, |target| target.starts_with(&home))
+}
+
+#[inline]
+#[cfg(not(target_os = "android"))]
+pub fn is_peer_path_allowed(_path: &str, _allow_empty: bool) -> bool {
+    true
+}
+
 #[inline]
 pub fn is_main() -> bool {
    *IS_MAIN
--- a/src/flutter_ffi.rs
+++ b/src/flutter_ffi.rs
@@ -2912,6 +2912,7 @@ pub mod server_side {
        env: JNIEnv,
        _class: JClass,
        app_dir: JString,
+        home_dir: JString,
        custom_client_config: JString,
    ) {
        log::debug!("startServer from jvm");
@@ -2919,6 +2920,9 @@ pub mod server_side {
        if let Ok(app_dir) = env.get_string(&app_dir) {
            *config::APP_DIR.write().unwrap() = app_dir.into();
        }
+        if let Ok(home_dir) = env.get_string(&home_dir) {
+            *config::APP_HOME_DIR.write().unwrap() = home_dir.into();
+        }
        if let Ok(custom_client_config) = env.get_string(&custom_client_config) {
            if !custom_client_config.is_empty() {
                let custom_client_config: String = custom_client_config.into();
--- a/src/lang/ar.rs
+++ b/src/lang/ar.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "لقطة الشاشة للشاشات المدمجة غير مدعومة"),
        ("screenshot-action-tip", "إجراء لقطة الشاشة"),
        ("Save as", "حفظ باسم"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "نسخ إلى الحافظة"),
        ("Enable remote printer", "تمكين الطابعة عن بُعد"),
        ("Downloading {}", "جارٍ تنزيل {}"),
--- a/src/lang/be.rs
+++ b/src/lang/be.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Аб’яднанне здымкаў экранаў з некалькіх дысплэяў у дадзены момант не падтрымліваецца. Пераключыцеся на адзін з дысплэяў і паўтарыце дзеянне."),
        ("screenshot-action-tip", "Выберыце, што рабіць з атрыманым здымкам экрана."),
        ("Save as", "Захаваць у файл"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Скапіяваць у буфер абмену"),
        ("Enable remote printer", "Выкарыстоўваць аддалены прынтар"),
        ("Downloading {}", "Ідзе спампоўванне {}"),
--- a/src/lang/bg.rs
+++ b/src/lang/bg.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Обединяването на снимки от няколко екрана в момента не се поддържа. Моля, превключете към един екран и опитайте отново."),
        ("screenshot-action-tip", "Моля, изберете как да продължите със снимката на екрана."),
        ("Save as", "Запазване като"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Копиране в клипборда"),
        ("Enable remote printer", "Позволяване на отдалечен принтер"),
        ("Downloading {}", "Изтегляне на {}"),
--- a/src/lang/ca.rs
+++ b/src/lang/ca.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Actualment no és possible combinar captures de pantalla de diverses pantalles. Canvieu a una sola pantalla i torneu a provar."),
        ("screenshot-action-tip", "Seleccioneu com voleu continuar amb la captura de pantalla."),
        ("Save as", "Anomena i desa"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Copia al porta-retalls"),
        ("Enable remote printer", "Habilita l'impressora remota"),
        ("Downloading {}", "Descarregant {}"),
--- a/src/lang/cn.rs
+++ b/src/lang/cn.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "当前不支持多个屏幕的合并截屏，请切换到单个屏幕重试。"),
        ("screenshot-action-tip", "请选择如何继续截屏。"),
        ("Save as", "另存为"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "复制到剪贴板"),
        ("Enable remote printer", "启用远程打印机"),
        ("Downloading {}", "正在下载 {}"),
--- a/src/lang/cs.rs
+++ b/src/lang/cs.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Sloučení snímků obrazovky z více displejů aktuálně není podporováno. Přepněte na jeden displej a zkuste to znovu."),
        ("screenshot-action-tip", "Vyberte, jak pokračovat se snímkem obrazovky."),
        ("Save as", "Uložit jako"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopírovat do schránky"),
        ("Enable remote printer", "Povolit vzdálenou tiskárnu"),
        ("Downloading {}", "Stahuje se {}"),
--- a/src/lang/da.rs
+++ b/src/lang/da.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Sammenfletning af skærmbilleder fra flere skærme understøttes ikke i øjeblikket. Skift venligst til en enkelt skærm og prøv igen."),
        ("screenshot-action-tip", "Vælg venligst, hvordan du vil fortsætte med skærmbilledet."),
        ("Save as", "Gem som"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopiér til udklipsholder"),
        ("Enable remote printer", "Aktivér fjernprinter"),
        ("Downloading {}", "Downloader {}"),
--- a/src/lang/de.rs
+++ b/src/lang/de.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Das Zusammenführen von Screenshots von mehreren Bildschirmen wird derzeit nicht unterstützt. Bitte wechseln Sie zu einem einzelnen Bildschirm und versuchen Sie es erneut."),
        ("screenshot-action-tip", "Bitte wählen Sie aus, wie Sie mit dem Screenshot fortfahren möchten."),
        ("Save as", "Speichern unter"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "In Zwischenablage kopieren"),
        ("Enable remote printer", "Entfernten Drucker aktivieren"),
        ("Downloading {}", "{} herunterladen"),
--- a/src/lang/el.rs
+++ b/src/lang/el.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Η συγχώνευση στιγμιότυπων οθόνης από πολλές οθόνες δεν υποστηρίζεται προς το παρόν. Αλλάξτε σε μία μόνο οθόνη και δοκιμάστε ξανά."),
        ("screenshot-action-tip", "Επιλέξτε πώς θα συνεχίσετε με το στιγμιότυπο οθόνης."),
        ("Save as", "Αποθήκευση ως"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Αντιγραφή στο πρόχειρο"),
        ("Enable remote printer", "Ενεργοποίηση απομακρυσμένου εκτυπωτή"),
        ("Downloading {}", "Γίνεται Λήψη {}"),
--- a/src/lang/eo.rs
+++ b/src/lang/eo.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Kunfandi ekrankopiojn de pluraj ekranoj aktuale ne estas subtenata. Bonvolu ŝanĝi al unu ekrano kaj reprovi."),
        ("screenshot-action-tip", "Bonvolu elekti kiel daŭrigi kun la ekrankopio."),
        ("Save as", "Konservi kiel"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopii al la poŝo"),
        ("Enable remote printer", "Ebligi foran presilon"),
        ("Downloading {}", "Elŝutas {}"),
--- a/src/lang/es.rs
+++ b/src/lang/es.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "La fusión de capturas de pantalla de múltiples monitores no está soportada. Por favor, cambie a un monitor e inténtelo de nuevo."),
        ("screenshot-action-tip", "Por favor, seleccione cómo continuar con la captura de pantalla."),
        ("Save as", "Guardar como"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Copiar al portapapeles"),
        ("Enable remote printer", "Habilitar impresora remota"),
        ("Downloading {}", "Descargando {}"),
--- a/src/lang/et.rs
+++ b/src/lang/et.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Mitme kuva kuvatõmmiste ühendamine pole praegu toetatud. Palun lülitu ühele kuvale ja proovi uuesti."),
        ("screenshot-action-tip", "Palun vali, kuidas kuvatõmmisega jätkata."),
        ("Save as", "Salvesta kui"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopeeri lõikelauale"),
        ("Enable remote printer", "Luba kaugprinter"),
        ("Downloading {}", "Allalaadimine: {}"),
--- a/src/lang/eu.rs
+++ b/src/lang/eu.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Pantaila anitzen pantaila-argazkiak bateratzea ez da onartzen une honetan. Aldatu pantaila bakarrera eta saiatu berriro."),
        ("screenshot-action-tip", "Hautatu pantaila-argazkiarekin nola jarraitu."),
        ("Save as", "Gorde honela"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopiatu arbelera"),
        ("Enable remote printer", "Gaitu urruneko inprimagailua"),
        ("Downloading {}", "{} deskargatzen"),
--- a/src/lang/fa.rs
+++ b/src/lang/fa.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "ادغام تصاویر از نمایشگرهای متعدد در حال حاضر پشتیبانی نمی شود. لطفاً به یک صفحه نمایش واحد تغییر دهید و دوباره امتحان کنید."),
        ("screenshot-action-tip", "لطفاً نحوه ادامه با تصویر را انتخاب کنید."),
        ("Save as", "ذخیره به عنوان"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "در کلیپ بورد کپی کنید"),
        ("Enable remote printer", "چاپگر از راه دور را فعال کنید"),
        ("Downloading {}", "بارگیری {}"),
--- a/src/lang/fi.rs
+++ b/src/lang/fi.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Yhdistetyn näytön kuvakaappaus ei ole tuettu"),
        ("screenshot-action-tip", "Valitse, mitä haluat tehdä kuvakaappaukselle"),
        ("Save as", "Tallenna nimellä"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopioi leikepöydälle"),
        ("Enable remote printer", "Ota etätulostin käyttöön"),
        ("Downloading {}", "Ladataan {}"),
--- a/src/lang/fr.rs
+++ b/src/lang/fr.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Actuellement, la prise de capture d’écran ne prend pas en charge les affichages multiples. Veuillez réessayer après avoir sélectionné un seul affichage."),
        ("screenshot-action-tip", "Veuillez choisir l’action à effectuer avec la capture d’écran."),
        ("Save as", "Enregistrer sous"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Copier dans le presse-papier"),
        ("Enable remote printer", "Activer l’impression à distance"),
        ("Downloading {}", "Téléchargement de {}"),
--- a/src/lang/ge.rs
+++ b/src/lang/ge.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "რამდენიმე ეკრანის სურათის გაერთიანება ამჟამად მხარდაჭერილი არ არის. გადართეთ ერთ ეკრანზე და სცადეთ ხელახლა."),
        ("screenshot-action-tip", "აირჩიეთ, როგორ გავაგრძელოთ ეკრანის სურათთან მუშაობა."),
        ("Save as", "შენახვა როგორც"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "ბუფერში კოპირება"),
        ("Enable remote printer", "დისტანციური პრინტერის ჩართვა"),
        ("Downloading {}", "მიმდინარეობს {}-ის ჩამოტვირთვა"),
--- a/src/lang/gu.rs
+++ b/src/lang/gu.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "મર્જ કરેલ સ્ક્રીનશોટ સપોર્ટેડ નથી."),
        ("screenshot-action-tip", "સ્ક્રીનશોટ પછીની ક્રિયા"),
        ("Save as", "તરીકે સાચવો"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "ક્લિપબોર્ડમાં કોપી કરો"),
        ("Enable remote printer", "રિમોટ પ્રિન્ટર સક્ષમ કરો"),
        ("Downloading {}", "{} ડાઉનલોડ થઈ રહ્યું છે"),
--- a/src/lang/he.rs
+++ b/src/lang/he.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "צילום מסך משולב מכל המסכים אינו נתמך"),
        ("screenshot-action-tip", "בחר פעולה לאחר צילום המסך"),
        ("Save as", "שמור בשם"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "העתק ללוח"),
        ("Enable remote printer", "אפשר מדפסת מרוחקת"),
        ("Downloading {}", "מוריד את {}"),
--- a/src/lang/hi.rs
+++ b/src/lang/hi.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "मर्ज की गई स्क्रीन के स्क्रीनशॉट समर्थित नहीं हैं।"),
        ("screenshot-action-tip", "स्क्रीनशॉट लेने के बाद की कार्रवाई"),
        ("Save as", "इस रूप में सहेजें"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "क्लिपबोर्ड पर कॉपी करें"),
        ("Enable remote printer", "रिमोट प्रिंटर सक्षम करें"),
        ("Downloading {}", "{} डाउनलोड हो रहा है"),
--- a/src/lang/hr.rs
+++ b/src/lang/hr.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Spajanje snimaka zaslona s više zaslona trenutačno nije podržano. Prebacite se na jedan zaslon i pokušajte ponovno."),
        ("screenshot-action-tip", "Odaberite kako nastaviti sa snimkom zaslona."),
        ("Save as", "Spremi kao"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopiraj u međuspremnik"),
        ("Enable remote printer", "Omogući udaljeni pisač"),
        ("Downloading {}", "Preuzimanje {}"),
--- a/src/lang/hu.rs
+++ b/src/lang/hu.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Egyesített képernyőről nem támogatott a képernyőkép készítése"),
        ("screenshot-action-tip", "Képernyőkép-művelet"),
        ("Save as", "Mentés másként"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Másolás a vágólapra"),
        ("Enable remote printer", "Távoli nyomtatók engedélyezése"),
        ("Downloading {}", "{} letöltése"),
--- a/src/lang/id.rs
+++ b/src/lang/id.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Menggabungkan tangkapan layar dari beberapa tampilan saat ini tidak didukung. Silakan beralih ke satu tampilan dan coba lagi."),
        ("screenshot-action-tip", "Silakan pilih cara melanjutkan dengan tangkapan layar."),
        ("Save as", "Simpan sebagai"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Salin ke papan klip"),
        ("Enable remote printer", "Aktifkan printer jarak jauh"),
        ("Downloading {}", "Mendownload {}"),
--- a/src/lang/it.rs
+++ b/src/lang/it.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "L'unione della cattura di schermate di più display non è attualmente supportata.\nPassa ad un singolo display e riprova."),
        ("screenshot-action-tip", "Seleziona come continuare con la schermata."),
        ("Save as", "Salva come"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Copia negli appunti"),
        ("Enable remote printer", "Abilita stampante remota"),
        ("Downloading {}", "Download {}"),
--- a/src/lang/ja.rs
+++ b/src/lang/ja.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "複数のディスプレイのスクリーンショットの結合は、現在非対応です。単一のディスプレイに切り替えてもう一度お試しください。"),
        ("screenshot-action-tip", "スクリーンショットを続行する方法を選択してください。"),
        ("Save as", "保存先"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "クリップボードにコピー"),
        ("Enable remote printer", "リモートプリンターを有効化する"),
        ("Downloading {}", "{} をダウンロード中"),
--- a/src/lang/ko.rs
+++ b/src/lang/ko.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "현재 다중 디스플레이의 스크린샷 병합이 지원되지 않습니다. 단일 디스플레이로 전환한 후 다시 시도해 주세요."),
        ("screenshot-action-tip", "스크린샷을 계속 진행할 방법을 선택해 주세요."),
        ("Save as", "다른 이름으로 저장"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "클립보드에 복사"),
        ("Enable remote printer", "원격 프린터 허용"),
        ("Downloading {}", "{} 다운로드 중"),
--- a/src/lang/kz.rs
+++ b/src/lang/kz.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Бірнеше дисплейдің скриншоттарын біріктіруге қазір қолдау көрсетілмейді. Жеке дисплейге ауысып, қайталап көруді өтінеміз."),
        ("screenshot-action-tip", "Скриншотпен қалай жалғастыру керектігін таңдауды өтінеміз."),
        ("Save as", "Басқаша сақтау"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Көшіру-тақтаға көшіру"),
        ("Enable remote printer", "Қашықтағы принтерді іске қосу"),
        ("Downloading {}", "{} жүктелуде"),
--- a/src/lang/lt.rs
+++ b/src/lang/lt.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Kelių ekranų nuotraukų sujungimas šiuo metu nepalaikomas. Perjunkite į vieną ekraną ir bandykite dar kartą."),
        ("screenshot-action-tip", "Pasirinkite, ką daryti su ekrano nuotrauka."),
        ("Save as", "Įrašyti kaip"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopijuoti į iškarpinę"),
        ("Enable remote printer", "Įgalinti nuotolinį spausdintuvą"),
        ("Downloading {}", "Atsisiunčiama {}"),
--- a/src/lang/lv.rs
+++ b/src/lang/lv.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Vairāku displeju ekrānuzņēmumu apvienošana pašlaik netiek atbalstīta. Lūdzu, pārslēdzieties uz vienu displeju un mēģiniet vēlreiz."),
        ("screenshot-action-tip", "Lūdzu, atlasiet, kā turpināt darbu ar ekrānuzņēmumu."),
        ("Save as", "Saglabāt kā"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopēt starpliktuvē"),
        ("Enable remote printer", "Iespējot attālo printeri"),
        ("Downloading {}", "Notiek {} lejupielāde"),
--- a/src/lang/ml.rs
+++ b/src/lang/ml.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "മെർജ് ചെയ്ത സ്ക്രീൻഷോട്ട് പിന്തുണയ്ക്കുന്നില്ല."),
        ("screenshot-action-tip", "സ്ക്രീൻഷോട്ടിന് ശേഷമുള്ള നടപടി"),
        ("Save as", "പേരിൽ സേവ് ചെയ്യുക"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "ക്ലിപ്പ്ബോർഡിലേക്ക് കോപ്പി ചെയ്യുക"),
        ("Enable remote printer", "റിമോട്ട് പ്രിന്റർ അനുവദിക്കുക"),
        ("Downloading {}", "{} ഡൗൺലോഡ് ചെയ്യുന്നു"),
--- a/src/lang/nb.rs
+++ b/src/lang/nb.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Sammenslåing av skjermbilder fra flere skjermer støttes for øyeblikket ikke. Bytt til én enkelt skjerm og prøv igjen."),
        ("screenshot-action-tip", "Velg hvordan du vil fortsette med skjermbildet."),
        ("Save as", "Lagre som"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopier til utklipstavlen"),
        ("Enable remote printer", "Aktiver fjernskriver"),
        ("Downloading {}", "Laster ned {}"),
--- a/src/lang/nl.rs
+++ b/src/lang/nl.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Schermopnames van meerdere schermen samenvoegen wordt momenteel niet ondersteund. Schakel over naar een enkel scherm en herhaal de actie."),
        ("screenshot-action-tip", "Kies wat je met de gemaakte schermopname wilt doen."),
        ("Save as", "Opslaan als"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopiëren naar het klembord"),
        ("Enable remote printer", "Printer op afstand inschakelen"),
        ("Downloading {}", "Downloaden {}"),
--- a/src/lang/pl.rs
+++ b/src/lang/pl.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Łączenie zrzutów ekranu z wielu wyświetlaczy nie jest obecnie obsługiwane. Przełącz się na pojedynczy wyświetlacz i spróbuj ponownie."),
        ("screenshot-action-tip", "Wybierz sposób kontynuacji zrzutu ekranu."),
        ("Save as", "Zapisz jako"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopiuj do schowka"),
        ("Enable remote printer", "Włącz zdalne drukowanie"),
        ("Downloading {}", "Pobieranie {}"),
--- a/src/lang/pt_PT.rs
+++ b/src/lang/pt_PT.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "A junção de capturas de ecrã de vários ecrãs não é atualmente suportada. Mude para um único ecrã e tente novamente."),
        ("screenshot-action-tip", "Selecione como pretende continuar com a captura de ecrã."),
        ("Save as", "Guardar como"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Copiar para a área de transferência"),
        ("Enable remote printer", "Ativar impressora remota"),
        ("Downloading {}", "A transferir {}"),
--- a/src/lang/ptbr.rs
+++ b/src/lang/ptbr.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "A captura de tela de múltiplas telas não é suportada no momento. Por favor, alterne para uma única tela e tente novamente."),
        ("screenshot-action-tip", "Por favor, selecione como deseja continuar com a captura de tela."),
        ("Save as", "Salvar como"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Copiar para área de transferência"),
        ("Enable remote printer", "Habilitar impressora remota"),
        ("Downloading {}", "Baixando {}"),
--- a/src/lang/ro.rs
+++ b/src/lang/ro.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Captura de ecran a ecranului combinat nu este suportată în prezent."),
        ("screenshot-action-tip", "Selectează acțiunea pentru captura de ecran: salvează ca fișier sau copiază în clipboard."),
        ("Save as", "Salvează ca"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Copiază în clipboard"),
        ("Enable remote printer", "Activează imprimanta la distanță"),
        ("Downloading {}", "Se descarcă {}"),
--- a/src/lang/ru.rs
+++ b/src/lang/ru.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Объединение снимков экранов с нескольких дисплеев в настоящее время не поддерживается. Переключитесь на один дисплей и повторите действие."),
        ("screenshot-action-tip", "Выберите, что делать с полученным снимком экрана."),
        ("Save as", "Сохранить в файл"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Копировать в буфер обмена"),
        ("Enable remote printer", "Использовать удалённый принтер"),
        ("Downloading {}", "Скачивание"),
--- a/src/lang/sc.rs
+++ b/src/lang/sc.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "S'unione de sa catura de ischermadas de prus ischermos como no est suportada.\nCola a un'ischermu ebbia e torra a proare."),
        ("screenshot-action-tip", "Seletziona comente sighire cun s'ischermada."),
        ("Save as", "Sarva comente"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Còpia in punta de billete"),
        ("Enable remote printer", "Abìlita imprentadora remota"),
        ("Downloading {}", "Iscarrighende {}"),
--- a/src/lang/sk.rs
+++ b/src/lang/sk.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Zlučovanie snímok obrazovky z viacerých displejov nie je momentálne podporované. Prepnite na jeden displej a skúste to znova."),
        ("screenshot-action-tip", "Vyberte, ako pokračovať so snímkou obrazovky."),
        ("Save as", "Uložiť ako"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopírovať do schránky"),
        ("Enable remote printer", "Povoliť vzdialenú tlačiareň"),
        ("Downloading {}", "Sťahuje sa {}"),
--- a/src/lang/sl.rs
+++ b/src/lang/sl.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Združevanje posnetkov zaslona z več zaslonov trenutno ni podprto. Preklopite na en zaslon in poskusite znova."),
        ("screenshot-action-tip", "Izberite, kako nadaljevati s posnetkom zaslona."),
        ("Save as", "Shrani kot"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopiraj v odložišče"),
        ("Enable remote printer", "Omogoči oddaljeni tiskalnik"),
        ("Downloading {}", "Prenašanje {}"),
--- a/src/lang/sq.rs
+++ b/src/lang/sq.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Bashkimi i pamjeve të ekranit nga disa ekrane aktualisht nuk mbështetet. Ju lutemi kaloni te një ekran i vetëm dhe provoni përsëri."),
        ("screenshot-action-tip", "Ju lutemi zgjidhni si të vazhdoni me pamjen e ekranit."),
        ("Save as", "Ruaj si"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopjo te clipboard"),
        ("Enable remote printer", "Aktivizo printerin në distancë"),
        ("Downloading {}", "Duke shkarkuar {}"),
--- a/src/lang/sr.rs
+++ b/src/lang/sr.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Spajanje snimaka ekrana sa više prikaza trenutno nije podržano. Molimo prebacite na jedan prikaz i pokušajte ponovo."),
        ("screenshot-action-tip", "Molimo izaberite kako da nastavite sa snimkom ekrana."),
        ("Save as", "Sačuvaj kao"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kopiraj u clipboard"),
        ("Enable remote printer", "Omogući udaljeni štampač"),
        ("Downloading {}", "Preuzimanje {}"),
--- a/src/lang/sv.rs
+++ b/src/lang/sv.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Sammanslagning av skärmdumpar från flera skärmar stöds för närvarande inte. Byt till en enda skärm och försök igen."),
        ("screenshot-action-tip", "Välj hur du vill fortsätta med skärmdumpen."),
        ("Save as", "Spara som"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Kppiera till urklipp"),
        ("Enable remote printer", "Aktivera fjärrskrivare"),
        ("Downloading {}", "Laddar ner {}"),
--- a/src/lang/ta.rs
+++ b/src/lang/ta.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "ஸ்கிரீன்ஷாட்_இணைக்கப்பட்ட_திரை_ஆதரவற்ற_குறிப்பு"),
        ("screenshot-action-tip", "ஸ்கிரீன்ஷாட்_செயல்_குறிப்பு"),
        ("Save as", "இப்படி சேமி"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "கிளிப்போர்டில் நகல்"),
        ("Enable remote printer", "தொலை அச்சுப்பொறி இயக்கு"),
        ("Downloading {}", "{} பதிவிறக்குகிறது"),
--- a/src/lang/template.rs
+++ b/src/lang/template.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", ""),
        ("screenshot-action-tip", ""),
        ("Save as", ""),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", ""),
        ("Enable remote printer", ""),
        ("Downloading {}", ""),
--- a/src/lang/th.rs
+++ b/src/lang/th.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "ขณะนี้ยังไม่รองรับการรวมภาพหน้าจอจากหลายจอแสดงผล กรุณาสลับไปใช้จอแสดงผลเดียวแล้วลองใหม่"),
        ("screenshot-action-tip", "กรุณาเลือกวิธีดำเนินการต่อกับภาพหน้าจอ"),
        ("Save as", "บันทึกเป็น"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "คัดลอกไปยังคลิปบอร์ด"),
        ("Enable remote printer", "เปิดใช้งานเครื่องพิมพ์ระยะไกล"),
        ("Downloading {}", "กำลังดาวน์โหลด {}"),
--- a/src/lang/tr.rs
+++ b/src/lang/tr.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Birden fazla ekranın ekran görüntülerinin birleştirilmesi şu anda desteklenmiyor. Lütfen tek bir ekrana geçin ve tekrar deneyin."),
        ("screenshot-action-tip", "Lütfen ekran görüntüsüyle nasıl devam edeceğinizi seçin."),
        ("Save as", "Farklı kaydet"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Panoya kopyala"),
        ("Enable remote printer", "Uzak yazıcıyı etkinleştir"),
        ("Downloading {}", "{} indiriliyor"),
--- a/src/lang/tw.rs
+++ b/src/lang/tw.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "目前不支援合併多個螢幕的截圖。請切換至單一螢幕後再試。"),
        ("screenshot-action-tip", "請選擇要如何處理這張截圖。"),
        ("Save as", "另存為"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "複製到剪貼簿"),
        ("Enable remote printer", "啟用遠端列印"),
        ("Downloading {}", "正在下載 {} 並安裝新版本。"),
--- a/src/lang/uk.rs
+++ b/src/lang/uk.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Об'єднання знімків кількох дисплеїв наразі не підтримується. Перейдіть на один дисплей і спробуйте знову."),
        ("screenshot-action-tip", "Виберіть, що робити зі знімком екрана."),
        ("Save as", "Зберегти як"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Скопіювати до буфера обміну"),
        ("Enable remote printer", "Увімкнути віддалений принтер"),
        ("Downloading {}", "Завантаження {}"),
--- a/src/lang/vi.rs
+++ b/src/lang/vi.rs
@@ -659,6 +659,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("screenshot-merged-screen-not-supported-tip", "Không hỗ trợ chụp gộp nhiều màn hình."),
        ("screenshot-action-tip", "Hành động chụp màn hình"),
        ("Save as", "Lưu thành"),
+        ("Export", ""),
+        ("Export Logs", ""),
+        ("Import Folder", ""),
        ("Copy to clipboard", "Sao chép vào Clipboard"),
        ("Enable remote printer", "Bật máy in từ xa"),
        ("Downloading {}", "Đang tải xuống {}"),
--- a/src/server/connection.rs
+++ b/src/server/connection.rs
@@ -2021,11 +2021,17 @@ impl Connection {
        self.update_scoped_login_options().await;
        if let Some((dir, show_hidden)) = self.file_transfer.clone() {
            self.keyboard = false;
-            let dir = if !dir.is_empty() && std::path::Path::new(&dir).is_dir() {
-                &dir
-            } else {
-                ""
-            };
+            let is_existing_dir = !dir.is_empty() && std::path::Path::new(&dir).is_dir();
+            let is_allowed_dir =
+                is_existing_dir && crate::common::is_peer_path_allowed(&dir, false);
+            #[cfg(target_os = "android")]
+            if is_existing_dir && !is_allowed_dir {
+                log::warn!(
+                    "Use the app workspace because the initial file-transfer directory is outside it: {}",
+                    dir
+                );
+            }
+            let dir = if is_allowed_dir { &dir } else { "" };
            if !wait_session_id_confirm {
                self.read_dir(dir, show_hidden);
            } else {
@@ -3313,6 +3319,81 @@ impl Connection {
                                return true;
                            }
                        }
+                        // Android is scoped-storage only: reject any peer supplied path that
+                        // escapes the app workspace before it reaches the filesystem.
+                        #[cfg(target_os = "android")]
+                        {
+                            // (path, job id, allow empty) of the peer supplied path this action
+                            // operates on.
+                            let checked: Option<(&str, i32, bool)> = match &fa.union {
+                                Some(file_action::Union::ReadEmptyDirs(rd)) => {
+                                    Some((rd.path.as_str(), -1, false))
+                                }
+                                Some(file_action::Union::ReadDir(rd)) => {
+                                    Some((rd.path.as_str(), 0, true))
+                                }
+                                Some(file_action::Union::AllFiles(f)) => {
+                                    Some((f.path.as_str(), f.id, false))
+                                }
+                                Some(file_action::Union::Send(s)) => {
+                                    // Printer jobs read from memory, `path` is only a lookup key.
+                                    if JobType::from_proto(s.file_type) == JobType::Generic {
+                                        Some((s.path.as_str(), s.id, false))
+                                    } else {
+                                        None
+                                    }
+                                }
+                                Some(file_action::Union::Receive(r)) => {
+                                    Some((r.path.as_str(), r.id, false))
+                                }
+                                Some(file_action::Union::RemoveDir(d)) => {
+                                    Some((d.path.as_str(), d.id, false))
+                                }
+                                Some(file_action::Union::RemoveFile(f)) => {
+                                    Some((f.path.as_str(), f.id, false))
+                                }
+                                Some(file_action::Union::Create(c)) => {
+                                    Some((c.path.as_str(), c.id, false))
+                                }
+                                Some(file_action::Union::Rename(r)) => {
+                                    Some((r.path.as_str(), r.id, false))
+                                }
+                                _ => None,
+                            };
+                            if let Some((path, job_id, allow_empty)) = checked {
+                                if !crate::common::is_peer_path_allowed(path, allow_empty) {
+                                    log::warn!(
+                                        "Reject file action outside the app workspace: {}",
+                                        path
+                                    );
+                                    if job_id >= 0 {
+                                        self.send(fs::new_error(job_id, "Permission denied", -1))
+                                            .await;
+                                    }
+                                    return true;
+                                }
+                            }
+                            if let Some(file_action::Union::Rename(r)) = &fa.union {
+                                let destination = std::path::Path::new(&r.path)
+                                    .parent()
+                                    .map(|parent| parent.join(&r.new_name));
+                                let allowed = destination
+                                    .as_deref()
+                                    .and_then(std::path::Path::to_str)
+                                    .map_or(false, |path| {
+                                        crate::common::is_peer_path_allowed(path, false)
+                                    });
+                                if !allowed {
+                                    log::warn!(
+                                        "Reject rename destination outside the app workspace: {:?}",
+                                        destination
+                                    );
+                                    self.send(fs::new_error(r.id, "Permission denied", -1))
+                                        .await;
+                                    return true;
+                                }
+                            }
+                        }
                        match fa.union {
                            Some(file_action::Union::ReadEmptyDirs(rd)) => {
                                self.read_empty_dirs(&rd.path, rd.include_hidden);
--- a/src/ui_cm_interface.rs
+++ b/src/ui_cm_interface.rs
@@ -977,6 +977,61 @@ async fn handle_fs(
    tx_log: Option<&UnboundedSender<String>>,
    _conn_id: i32,
 ) {
+    // Android is scoped-storage only, so every peer supplied path has to stay inside the
+    // app workspace. This is the filesystem boundary, keep it enforced here even though
+    // `Connection` rejects out-of-workspace requests earlier as well.
+    #[cfg(target_os = "android")]
+    {
+        // (path, job id, file num, allow empty) of the peer supplied path this message
+        // acts on.
+        let checked: Option<(&str, i32, i32, bool)> = match &fs {
+            ipc::FS::ReadEmptyDirs { dir, .. } => Some((dir.as_str(), -1, -1, false)),
+            ipc::FS::ReadDir { dir, .. } => Some((dir.as_str(), -1, -1, true)),
+            ipc::FS::RemoveDir { path, id, .. } | ipc::FS::CreateDir { path, id } => {
+                Some((path.as_str(), *id, 0, false))
+            }
+            ipc::FS::Rename { path, id, .. } => Some((path.as_str(), *id, 0, false)),
+            ipc::FS::RemoveFile { path, id, file_num } => {
+                Some((path.as_str(), *id, *file_num, false))
+            }
+            ipc::FS::ReadAllFiles { path, id, .. } => Some((path.as_str(), *id, -1, false)),
+            ipc::FS::NewWrite {
+                path, id, file_num, ..
+            }
+            | ipc::FS::ReadFile {
+                path, id, file_num, ..
+            } => Some((path.as_str(), *id, *file_num, false)),
+            _ => None,
+        };
+        if let Some((path, id, file_num, allow_empty)) = checked {
+            if !crate::common::is_peer_path_allowed(path, allow_empty) {
+                log::warn!("Reject file operation outside the app workspace: {}", path);
+                if id >= 0 {
+                    send_raw(fs::new_error(id, "Permission denied", file_num), tx);
+                }
+                return;
+            }
+        }
+        if let ipc::FS::Rename { path, new_name, id } = &fs {
+            let destination = std::path::Path::new(path)
+                .parent()
+                .map(|parent| parent.join(new_name));
+            let allowed = destination
+                .as_deref()
+                .and_then(std::path::Path::to_str)
+                .map_or(false, |path| {
+                    crate::common::is_peer_path_allowed(path, false)
+                });
+            if !allowed {
+                log::warn!(
+                    "Reject rename destination outside the app workspace: {:?}",
+                    destination
+                );
+                send_raw(fs::new_error(*id, "Permission denied", 0), tx);
+                return;
+            }
+        }
+    }
    match fs {
        ipc::FS::ReadEmptyDirs {
            dir,