Listing only subfolders and a user has permission for

Question

A CompleteFTP Enterprise MFT user asked:

In my CompleteFTP server (Enterprise MFT edition), I want to add a folder that dynamically hides any subfolders or files the current OS user (Windows or Linux) does not have permission to access. The goal is to prevent users from even seeing directories they can’t open, similar to Access-Based Enumeration (ABE) in Windows file shares.

Is there a way to make CompleteFTP list only the subfolders and files that the current user can actually access?

Answer 1

Yes — in CompleteFTP Enterprise MFT, you can create a JavaScript (JSS) file-system extension that filters directory listings so only content that the current OS user (Windows or Linux) has permission to access is shown. This allows you to dynamically hide any entries the user lacks access to.

How to set it up:

1. In CompleteFTP Manager, go to the Extensions panel.

2. Click Add extension > JavaScript (JSS) extension > File System.

3. Name the extension something like Filtered Folder.

4. Paste the following code into the script editor:

function getBaseType() {
    return "windows";
}

function getFileInfos(path, pattern, session, node) {
    return base.getFileInfos().filter(f =>
        !f.isFolder || hasListPermission(system.getFile(`${node.path}/${path}/${f.name}`))
    );
}

function hasListPermission(folder) {
    try {
        // Attempt to enumerate contents — succeeds only if user has ListFolder permission
        System.IO.Directory.EnumerateFileSystemEntries(folder.adapterAbsolutePath).GetEnumerator().Dispose();
        return true;
    }
    catch (e) {
        return false;
    }
}

Behavior summary:

• Works for any subfolder at any depth beneath the mounted folder.

• Automatically respects inherited ACLs, deny rules, and other OS-level permissions.

• Filters both files and directories, only showing items that the current user has permission to list.

• Works for OS users — i.e., authenticated users mapped to Windows or Linux accounts via CompleteFTP.

• No special handling of ACLs is required — access is tested directly by attempting a listing.

---

This approach is ideal if you want to emulate ABE-style visibility without manually managing permissions in your application layer. Let us know if you'd like a version that includes logging for easier debugging or auditing.