From 21f2455bcba66c435bf38227d282dbc35ea14bd8 Mon Sep 17 00:00:00 2001
From: Josh Eckels <jeckels@labkey.com>
Date: Mon, 13 Jul 2026 17:21:03 -0700
Subject: [PATCH 1/5] GitHub Issue 1300: BulkUpgradeGroupAction scoping changes
 (#7836)

## Rationale
BulkUpgradeGroupAction is inconsistent with other actions for its
permission checks

## Changes
- Check container and for a separate permission for adding a new user
---
 .../org/labkey/core/security/SecurityApiActions.java  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/core/src/org/labkey/core/security/SecurityApiActions.java b/core/src/org/labkey/core/security/SecurityApiActions.java
index 6c52e69f4f1..540fdbf2a5d 100644
--- a/core/src/org/labkey/core/security/SecurityApiActions.java
+++ b/core/src/org/labkey/core/security/SecurityApiActions.java
@@ -1100,6 +1100,12 @@ public ApiResponse execute(GroupForm form, BindException errors)
                 throw new UnauthorizedException("You do not have permission to modify site-wide groups.");
             }
 
+            // A project group must belong to the current container
+            if (_group.getContainer() != null && !container.getId().equals(_group.getContainer()))
+            {
+                throw new UnauthorizedException("The specified group does not belong to this project.");
+            }
+
             SecurityController.verifyUserCanModifyGroup(_group, getUser());
 
             Map<String, String> memberErrors = new HashMap<>();
@@ -1213,6 +1219,11 @@ private void addOrReplaceMembers(GroupForm form, Map<String, List<UserPrincipal>
 
                     if (principal == null && member.getEmail() != null) // create the user
                     {
+                        if (!getContainer().hasPermission(getUser(), AddUserPermission.class))
+                        {
+                            memberErrors.put(member.getEmail(), "You do not have permission to create new users.");
+                            continue;
+                        }
                         try
                         {
                             SecurityManager.NewUserStatus status = SecurityManager.addUser(new ValidEmail(member.getEmail()), getUser());

From d9c1fbc16c7c2fd4d13a33a79efa78d837dbc7ff Mon Sep 17 00:00:00 2001
From: Trey Chadick <tchad@labkey.com>
Date: Wed, 22 Jul 2026 13:32:57 -0700
Subject: [PATCH 2/5] Fix provider parameter in addUsers.jsp (#7872)

https://github.com/LabKey/internal-issues/issues/1328
---
 core/src/org/labkey/core/security/addUsers.jsp | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/core/src/org/labkey/core/security/addUsers.jsp b/core/src/org/labkey/core/security/addUsers.jsp
index 80dcd6df68f..25741c0362f 100644
--- a/core/src/org/labkey/core/security/addUsers.jsp
+++ b/core/src/org/labkey/core/security/addUsers.jsp
@@ -40,11 +40,6 @@
     boolean excludeSiteAdmins = !getUser().hasSiteAdminPermission(); // App admins can't clone permissions from site admins
 %>
 <script type="text/javascript" nonce="<%=getScriptNonce()%>">
-    document.addEventListener("DOMContentLoaded", function() {
-        if (LABKEY.ActionURL.getParameter('provider')) {
-            document.getElementById('provider').value = LABKEY.ActionURL.getParameter('provider');
-        }
-    });
 
     function enableText()
     {
@@ -139,7 +134,7 @@
     <%
         if (form.getProvider() != null)
         {
-            %><input type="hidden" name="provider" id="provider" value=<%=h(form.getProvider())%>><%
+            %><input type="hidden" name="provider" id="provider" value="<%=h(form.getProvider())%>"><%
         }
         else
         {

From d07d28944f0c35369d0a71c98732b7da026a10e7 Mon Sep 17 00:00:00 2001
From: Karl Lum <klum@labkey.com>
Date: Wed, 5 Aug 2026 10:57:59 -0700
Subject: [PATCH 3/5] Additional check to ensure read access on the issue
 container. (#7905)

---
 .../org/labkey/issue/IssuesController.java    | 56 +++++++++++++++++++
 issues/src/org/labkey/issue/IssuesModule.java |  3 +-
 .../org/labkey/issue/model/IssueManager.java  | 21 ++++---
 3 files changed, 72 insertions(+), 8 deletions(-)

diff --git a/issues/src/org/labkey/issue/IssuesController.java b/issues/src/org/labkey/issue/IssuesController.java
index 38e68a5cbdd..1ff445b4132 100644
--- a/issues/src/org/labkey/issue/IssuesController.java
+++ b/issues/src/org/labkey/issue/IssuesController.java
@@ -113,6 +113,7 @@
 import org.labkey.api.security.roles.OwnerRole;
 import org.labkey.api.security.roles.ReaderRole;
 import org.labkey.api.security.roles.RoleManager;
+import org.labkey.api.security.roles.SubmitterRole;
 import org.labkey.api.util.ButtonBuilder;
 import org.labkey.api.util.CSRFUtil;
 import org.labkey.api.util.DOM;
@@ -2564,4 +2565,59 @@ private void deleteProjects()
             _projectA = null;
         }
     }
+
+    /**
+     * GitHub Issue 1317 regression test.
+     */
+    public static class GetIssuePermissionTestCase extends AbstractContainerScopingTest
+    {
+        private static final String ISSUE_TITLE = "getIssue() permission test issue";
+
+        @Test
+        public void testSubmitterCannotReadIssue() throws Exception
+        {
+            Container c = createIssuesContainer("Submitter");
+            int issueId = createIssue(c);
+
+            // A reader should be able to access the issue
+            User reader = createUserInRole(c, ReaderRole.class);
+            IssueObject asReader = IssueManager.getIssue(c, reader, issueId);
+            assertNotNull("Reader should be able to read the issue", asReader);
+            assertEquals(ISSUE_TITLE, asReader.getTitle());
+
+            // A submitter holds InsertPermission but not ReadPermission, so the issue shouldn't be accessible.
+            User submitter = createUserInRole(c, SubmitterRole.class);
+            assertNull("Submitter should not be able to read an issue", IssueManager.getIssue(c, submitter, issueId));
+            assertNull("Submitter should not be able to read an issue in an unspecified container", IssueManager.getIssue(null, submitter, issueId));
+        }
+
+        private Container createIssuesContainer(String name)
+        {
+            Container c = createContainer(name, ModuleLoader.getInstance().getModule(IssuesModule.NAME));
+
+            IssueListDef def = new IssueListDef();
+            def.setName(IssueListDef.DEFAULT_ISSUE_LIST_NAME);
+            def.setLabel(IssueListDef.DEFAULT_ISSUE_LIST_NAME);
+            def.setKind(IssueDefDomainKind.NAME);
+            def.beforeInsert(getAdmin(), c.getId());
+            def.save(getAdmin());
+
+            return c;
+        }
+
+        private int createIssue(Container c)
+        {
+            User admin = getAdmin();
+            IssueObject issue = new IssueObject();
+            issue.open(c, admin);
+            issue.setAssignedTo(admin.getUserId());
+            issue.setTitle(ISSUE_TITLE);
+            issue.setPriority("3");
+            issue.setIssueDefName(IssueListDef.DEFAULT_ISSUE_LIST_NAME);
+            ObjectFactory.Registry.getFactory(IssueObject.class).toMap(issue, issue.getProperties());
+            IssueManager.saveIssue(admin, c, issue);
+
+            return issue.getIssueId();
+        }
+    }
 }
diff --git a/issues/src/org/labkey/issue/IssuesModule.java b/issues/src/org/labkey/issue/IssuesModule.java
index 1b06988a612..1c872133166 100644
--- a/issues/src/org/labkey/issue/IssuesModule.java
+++ b/issues/src/org/labkey/issue/IssuesModule.java
@@ -193,7 +193,8 @@ public ActionURL getTabURL(Container c, User user)
         return Set.of(
             org.labkey.issue.model.IssueManager.TestCase.class,
             org.labkey.issue.IssuesController.MoveActionContainerScopingTestCase.class,
-            org.labkey.issue.IssuesController.GetUsersForGroupScopingTestCase.class
+            org.labkey.issue.IssuesController.GetUsersForGroupScopingTestCase.class,
+            org.labkey.issue.IssuesController.GetIssuePermissionTestCase.class
         );
     }
 
diff --git a/issues/src/org/labkey/issue/model/IssueManager.java b/issues/src/org/labkey/issue/model/IssueManager.java
index d598e313e94..bca543f3d5a 100644
--- a/issues/src/org/labkey/issue/model/IssueManager.java
+++ b/issues/src/org/labkey/issue/model/IssueManager.java
@@ -122,9 +122,9 @@
 import java.util.TreeSet;
 import java.util.function.Consumer;
 
-import static org.labkey.api.util.IntegerUtils.asInteger;
 import static org.labkey.api.search.SearchService.PROPERTY.categories;
 import static org.labkey.api.security.UserManager.USER_DISPLAY_NAME_COMPARATOR;
+import static org.labkey.api.util.IntegerUtils.asInteger;
 
 public class IssueManager
 {
@@ -240,14 +240,21 @@ public static IssueObject getIssue(
     private static IssueObject _getIssue(@Nullable Container c, User user, int issueId)
     {
         IssueObject issue = _getRawIssue(c, issueId);
+        if (issue == null)
+            return null;
 
-        if (issue != null && issue.getIssueDefId() != null)
-        {
-            // container may initially be null if we don't care about a specific folder, but we need the
-            // correct domain for the provisioned table properties associated with the issue
-            if (c == null)
-                c = ContainerManager.getForId(issue.getContainerId());
+        // container may initially be null if we don't care about a specific folder, but we need the
+        // correct domain for the provisioned table properties associated with the issue
+        if (c == null)
+            c = ContainerManager.getForId(issue.getContainerId());
 
+        // GitHub Issue 1317: explicitly check for read access on the target container before querying to
+        // avoid Submitter roles from accessing the table and then hitting an exception during the read.
+        if (c == null || !c.hasPermission(user, ReadPermission.class))
+            return null;
+
+        if (issue.getIssueDefId() != null)
+        {
             IssueListDef issueListDef = getIssueListDef(issue.getContainerFromId(), issue.getIssueDefId());
             UserSchema userSchema = QueryService.get().getUserSchema(user, c, IssuesQuerySchema.SCHEMA_NAME);
             TableInfo table = userSchema.getTable(issueListDef.getName());

From ba3ae3c41500db68fc60ba5b5451ce87cf749910 Mon Sep 17 00:00:00 2001
From: Adam Rauch <adam@labkey.com>
Date: Fri, 14 Aug 2026 07:05:30 -0700
Subject: [PATCH 4/5] Support MariaDB JDBC driver (#7912)

## Rationale
Supporting MariaDB means more keyword candidates

## Related Pull Requests
- https://github.com/LabKey/premiumModules/pull/684

## Changes
- Add some MariaDB-specific keywords
- Test `mysql.sakila` database if it's present
- Mask password parameter values when logging the connection URL
- Stricter JDBC URL parsing to support MariaDB no database + no slash
option

---------

Co-authored-by: labkey-tchad <tchad@labkey.com>
---
 api/src/org/labkey/api/data/DbScope.java      |  15 +-
 .../api/data/TableSelectorTestCase.java       | 128 ++++++++++--------
 .../api/data/dialect/StandardJdbcHelper.java  |  13 +-
 .../labkey/api/data/dialect/sqlKeywords.txt   |   8 +-
 4 files changed, 95 insertions(+), 69 deletions(-)

diff --git a/api/src/org/labkey/api/data/DbScope.java b/api/src/org/labkey/api/data/DbScope.java
index 022e7ef2870..5c8e1f2be51 100644
--- a/api/src/org/labkey/api/data/DbScope.java
+++ b/api/src/org/labkey/api/data/DbScope.java
@@ -591,7 +591,7 @@ private static LabKeyDataSource setPrimaryDataSource(Map<String, LabKeyDataSourc
                 LOG.info(
                         "Initializing DbScope with the following configuration:" +
                                 "\n    DataSource Name:          " + getDbScopeLoader().getDsName() +
-                                "\n    Server URL:               " + dbmd.getURL() +
+                                "\n    Server URL:               " + filterUrl(dbmd.getURL()) +
                                 "\n    Database Name:            " + _databaseName +
                                 "\n    Database Product Name:    " + _databaseProductName +
                                 "\n    Database Product Version: " + (null != _dialect ? _dialect.getProductVersion(_databaseProductVersion) : _databaseProductVersion) +
@@ -615,6 +615,19 @@ private static LabKeyDataSource setPrimaryDataSource(Map<String, LabKeyDataSourc
         }
     }
 
+    // MariaDB driver adds username and password to the URL. This masks the password so we don't log it.
+    private String filterUrl(String url)
+    {
+        int start = url.indexOf("password=");
+        if (start != -1)
+        {
+            start = start + 9;
+            int end = Math.max(url.length(), url.indexOf('&', start));
+            url = url.substring(0, start) + StringUtils.repeat('?', end - start) + url.substring(end);
+        }
+        return url;
+    }
+
     private String determineDriverLocation(Class<Driver> driverClass)
     {
         try
diff --git a/api/src/org/labkey/api/data/TableSelectorTestCase.java b/api/src/org/labkey/api/data/TableSelectorTestCase.java
index 4d1969eea0b..bd1ded108c1 100644
--- a/api/src/org/labkey/api/data/TableSelectorTestCase.java
+++ b/api/src/org/labkey/api/data/TableSelectorTestCase.java
@@ -38,84 +38,92 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.Date;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.stream.Stream;
 
-/**
-* User: adam
-* Date: 1/19/12
-* Time: 5:54 PM
-*/
 public class TableSelectorTestCase extends AbstractSelectorTestCase<TableSelector>
 {
     @Test
     public void testTableSelector() throws SQLException
     {
-//  Calls below can be used to test that Oracle and MySQL dialects behave as expected, following our maxRows, offset,
-//  and other rules. Uncomment these lines and their corresponding bean classes below.
+
+//  Call below can be used to test that Oracle dialect behaves as expected, following our maxRows, offset, and other
+//  rules. Uncomment this line and the corresponding bean class below.
 //        testTableSelector(DbSchema.get("oracle.granite", DbSchemaType.Bare).getTable("account"), Account.class);
-//        testTableSelector(DbSchema.get("mySql.sakila", DbSchemaType.Bare).getTable("country"), Country.class);
+
+        // Test MySQL or MariaDB database, if present
+        List<DbScope> mySqlScopes = Stream.of("mySql", "mariadb")
+                .map(DbScope::getDbScope).filter(Objects::nonNull).toList();
+        for (DbScope mySqlScope: mySqlScopes)
+        {
+            DbSchema sakila = mySqlScope.getSchema("sakila", DbSchemaType.Bare);
+            if (sakila.existsInDatabase())
+                testTableSelector(sakila.getTable("country"), Country.class);
+        }
         testTableSelector(CoreSchema.getInstance().getTableInfoActiveUsers(), User.class);
         testTableSelector(CoreSchema.getInstance().getTableInfoModules(), ModuleContext.class);
     }
 
-//    public static class Country
-//    {
-//        private int _country_id;
-//        private String _country;
-//        private Date _last_update;
-//
-//        public int getCountry_id()
-//        {
-//            return _country_id;
-//        }
-//
-//        public void setCountry_id(int country_id)
-//        {
-//            _country_id = country_id;
-//        }
-//
-//        public String getCountry()
-//        {
-//            return _country;
-//        }
-//
-//        public void setCountry(String country)
-//        {
-//            _country = country;
-//        }
-//
-//        public Date getLast_update()
-//        {
-//            return _last_update;
-//        }
-//
-//        public void setLast_update(Date last_update)
-//        {
-//            _last_update = last_update;
-//        }
-//
-//        @Override
-//        public boolean equals(Object o)
-//        {
-//            if (this == o) return true;
-//            if (o == null || getClass() != o.getClass()) return false;
-//            Country country = (Country) o;
-//            return _country_id == country._country_id && Objects.equals(_country, country._country) && Objects.equals(_last_update, country._last_update);
-//        }
-//
-//        @Override
-//        public int hashCode()
-//        {
-//            return Objects.hash(_country_id, _country, _last_update);
-//        }
-//    }
-//
+    @SuppressWarnings("unused")
+    public static class Country
+    {
+        private int _country_id;
+        private String _country;
+        private Date _last_update;
+
+        public int getCountry_id()
+        {
+            return _country_id;
+        }
+
+        public void setCountry_id(int country_id)
+        {
+            _country_id = country_id;
+        }
+
+        public String getCountry()
+        {
+            return _country;
+        }
+
+        public void setCountry(String country)
+        {
+            _country = country;
+        }
+
+        public Date getLast_update()
+        {
+            return _last_update;
+        }
+
+        public void setLast_update(Date last_update)
+        {
+            _last_update = last_update;
+        }
+
+        @Override
+        public boolean equals(Object o)
+        {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+            Country country = (Country) o;
+            return _country_id == country._country_id && Objects.equals(_country, country._country) && Objects.equals(_last_update, country._last_update);
+        }
+
+        @Override
+        public int hashCode()
+        {
+            return Objects.hash(_country_id, _country, _last_update);
+        }
+    }
+
 //    public static class Account
 //    {
 //        private int _account_id;
diff --git a/api/src/org/labkey/api/data/dialect/StandardJdbcHelper.java b/api/src/org/labkey/api/data/dialect/StandardJdbcHelper.java
index f2355b6bb7e..87e0d2f90d2 100644
--- a/api/src/org/labkey/api/data/dialect/StandardJdbcHelper.java
+++ b/api/src/org/labkey/api/data/dialect/StandardJdbcHelper.java
@@ -36,7 +36,7 @@ public String getDatabase(String url) throws ServletException
         return parseDatabase(url.substring(_prefix.length()));
     }
 
-    protected String parseDatabase(String url)
+    protected String parseDatabase(String url) throws ServletException
     {
         // Database name ends with '?' or end of the URL
         int dbEnd = url.indexOf('?');
@@ -44,12 +44,11 @@ protected String parseDatabase(String url)
         if (-1 == dbEnd)
             dbEnd = url.length();
 
-        // Database name starts after the last '/' or ':' 
-        int slash = url.lastIndexOf('/', dbEnd);
-        int colon = url.lastIndexOf(':', dbEnd);
+        // Last '/' is the database delimiter, except for "jdbc:postgresql:database"
+        char dbDelimiter = url.contains("/") ? '/' : ':';
+        int dbDelimiterIndex = url.lastIndexOf(dbDelimiter, dbEnd);
 
-        int dbDelimiter = Math.max(slash, colon);
-
-        return url.substring(dbDelimiter + 1, dbEnd);
+        // dbDelimiterIndex == 1 means no database name, so return empty string in that case
+        return dbDelimiterIndex != 1 ? url.substring(dbDelimiterIndex + 1, dbEnd) : "";
     }
 }
diff --git a/api/src/org/labkey/api/data/dialect/sqlKeywords.txt b/api/src/org/labkey/api/data/dialect/sqlKeywords.txt
index 82cfb83bfc6..59fc0a37dbb 100644
--- a/api/src/org/labkey/api/data/dialect/sqlKeywords.txt
+++ b/api/src/org/labkey/api/data/dialect/sqlKeywords.txt
@@ -1,7 +1,7 @@
 # A list of SQL keyword candidates -- all known and potential future keywords across all databases. We use this for testing.
 # Sources include the old, hard-coded keyword lists in the dialects, the reserved word lists in the PostgreSQL, MySQL, and
 # SQL Server documentation, and the return values of DatabaseMetaData.getSqlKeywords() for every database we support.
-# Note: build is required after altering this file.
+# Note: a build is required after altering this file.
 a
 abort
 abs
@@ -241,6 +241,7 @@ degree
 delay_key_write
 delayed
 delete
+delete_domain_id
 delimiter
 delimiters
 dense_rank
@@ -281,6 +282,7 @@ dlurlscheme
 dlurlserver
 dlvalue
 do
+do_domain_ids
 document
 domain
 double
@@ -432,6 +434,7 @@ identity_insert
 identitycol
 if
 ignore
+ignore_domain_ids
 ignore_server_ids
 ilike
 immediate
@@ -749,6 +752,7 @@ p
 pack_keys
 pad
 page
+page_checksum
 parallel
 parameter
 parameter_mode
@@ -759,6 +763,7 @@ parameter_specific_name
 parameter_specific_schema
 parameters
 parse_gcol_expr
+parse_vcol_expr
 parser
 partial
 partition
@@ -851,6 +856,7 @@ redo_buffer_size
 redofile
 redundant
 ref
+ref_system_id
 reference
 references
 referencing

From a57718cfd015e99e492a6bb0d21f96880ee30434 Mon Sep 17 00:00:00 2001
From: labkey-matthewb <matthewb@labkey.com>
Date: Thu, 20 Aug 2026 16:59:57 -0700
Subject: [PATCH 5/5] Merge from release25.7 (#7962)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Rationale
merge from 25.7_fb_root_refactor

## Related Pull Requests
- <!-- list of links to related pull requests (replace this comment) -->

## Changes
- <!-- list of descriptions of changes that are worth noting (replace
this comment) -->

<!-- list of standard tasks (remove this comment to enable)
## Tasks 📍
- [ ] Claude Code Review
- [ ] Manual Testing
- [ ] Test Automation
- [ ] Verify Fix
-->
---
 core/src/org/labkey/core/CoreModule.java      |   1 +
 .../labkey/core/admin/AdminController.java    | 129 ++++++++++++++++--
 2 files changed, 117 insertions(+), 13 deletions(-)

diff --git a/core/src/org/labkey/core/CoreModule.java b/core/src/org/labkey/core/CoreModule.java
index 550c5a80b2c..e391d350bbd 100644
--- a/core/src/org/labkey/core/CoreModule.java
+++ b/core/src/org/labkey/core/CoreModule.java
@@ -1465,6 +1465,7 @@ public TabDisplayMode getTabDisplayMode()
     public @NotNull Set<Class<?>> getUnitTests()
     {
         return Set.of(
+            AdminController.FileRootPermissionTestCase.class,
             ApiJsonWriter.TestCase.class,
             ClassLoaderTestCase.class,
             CopyFileRootPipelineJob.TestCase.class,
diff --git a/core/src/org/labkey/core/admin/AdminController.java b/core/src/org/labkey/core/admin/AdminController.java
index 6498f2c4930..f07766d4d3f 100644
--- a/core/src/org/labkey/core/admin/AdminController.java
+++ b/core/src/org/labkey/core/admin/AdminController.java
@@ -6259,6 +6259,7 @@ else if (form.hasSiteDefaultRoot())
             {
                 if (service.isFileRootDisabled(ctx.getContainer()) || !service.isUseDefaultRoot(ctx.getContainer()))
                 {
+                    throwIfUnauthorizedFileRootChange(ctx, service, form);
                     service.setIsUseDefaultRoot(ctx.getContainer(), true);
                     changed = true;
                     shouldCopyMove = true;
@@ -6403,22 +6404,62 @@ private static void initiateCopyFilesPipelineJobs(ViewContext ctx, @NotNull List
 
     private static void throwIfUnauthorizedFileRootChange(ViewContext ctx, FileContentService service, FileManagementForm form)
     {
-        // test permissions. only site admins are able to turn on a custom file root for a folder
-        // this is only relevant if the folder is either being switched to a custom file root,
-        // or if the file root is changed.
-        if (!service.isUseDefaultRoot(ctx.getContainer()))
-        {
-            Path fileRootPath = service.getFileRootPath(ctx.getContainer());
-            if (null != fileRootPath)
+        // Only site admins (AdminOperationsPermission) are able to switch a folder to a custom file root, change
+        // an existing custom root's path, or revert a custom root back to the site default -- any of these moves
+        // where the folder's files live. Resubmitting the folder's own current root unchanged is a no-op and does
+        // not require the elevated permission.
+        boolean hasAdminOpsPermission = ctx.getUser().hasRootPermission(AdminOperationsPermission.class);
+        boolean isUseDefaultRoot = service.isUseDefaultRoot(ctx.getContainer());
+        String requestedRoot;
+        String currentRoot;
+
+        if (form.hasSiteDefaultRoot())
+        {
+            // Requesting the default root: no root is being submitted; the current custom root (if any) is
+            // whatever type the container has now.
+            requestedRoot = null;
+            if (isUseDefaultRoot)
+                currentRoot = null;
+            else if (service.isCloudRoot(ctx.getContainer()))
+                currentRoot = service.getCloudRootName(ctx.getContainer());
+            else
             {
-                String absolutePath = FileUtil.getAbsolutePath(ctx.getContainer(), fileRootPath);
-                if (Strings.CI.equals(absolutePath, form.getFolderRootPath()))
-                {
-                    if (!ctx.getUser().hasRootPermission(AdminOperationsPermission.class))
-                        throw new UnauthorizedException("Only site admins can change file roots");
-                }
+                Path fileRootPath = service.getFileRootPath(ctx.getContainer());
+                currentRoot = null != fileRootPath ? FileUtil.getAbsolutePath(ctx.getContainer(), fileRootPath) : null;
             }
         }
+        else if (form.isCloudFileRoot())
+        {
+            requestedRoot = form.getCloudRootName();
+            currentRoot = (!isUseDefaultRoot && service.isCloudRoot(ctx.getContainer())) ? service.getCloudRootName(ctx.getContainer()) : null;
+        }
+        else
+        {
+            requestedRoot = StringUtils.trimToNull(form.getFolderRootPath());
+            Path fileRootPath = isUseDefaultRoot ? null : service.getFileRootPath(ctx.getContainer());
+            currentRoot = null != fileRootPath ? FileUtil.getAbsolutePath(ctx.getContainer(), fileRootPath) : null;
+        }
+
+        if (!isFileRootChangeAuthorizedOrNoChange(hasAdminOpsPermission, isUseDefaultRoot, currentRoot, requestedRoot))
+            throw new UnauthorizedException("Only site admins can change file roots");
+    }
+
+    /**
+     * Pure decision logic behind {@link #throwIfUnauthorizedFileRootChange}, factored out for unit testing.
+     * @param hasAdminOpsPermission whether the requesting user holds root AdminOperationsPermission
+     * @param isUseDefaultRoot whether the target container currently uses the default (inherited) file root
+     * @param currentRoot the container's existing custom root path/cloud name, or null if there isn't one
+     * @param requestedRoot the root path/cloud name submitted in the request, or null if none was submitted
+     */
+    private static boolean isFileRootChangeAuthorizedOrNoChange(boolean hasAdminOpsPermission, boolean isUseDefaultRoot, @Nullable String currentRoot, @Nullable String requestedRoot)
+    {
+        if (hasAdminOpsPermission)
+            return true;
+        if (null == requestedRoot)
+            return isUseDefaultRoot || null == currentRoot; // clearing an existing custom root is still a change to it
+        if (!isUseDefaultRoot && requestedRoot.equalsIgnoreCase(currentRoot))
+            return true; // no-op resubmission of the folder's own existing custom root
+        return false;
     }
 
     public static void setEnabledCloudStores(ViewContext ctx, FileManagementForm form, BindException errors)
@@ -9250,6 +9291,68 @@ public void modulesWithSchemaVersionButNoScripts()
         }
     }
 
+    // Regression coverage for the file root privilege-escalation fix: a folder/project admin without root
+    // AdminOperationsPermission must never be able to switch a container to a custom file root, or change an
+    // existing custom root's path.
+    public static class FileRootPermissionTestCase extends Assert
+    {
+        @Test
+        public void defaultRootRequiresAdminOpsPermissionForNewCustomPath()
+        {
+            // This is the case the original (inverted) condition silently skipped: a container on the default
+            // root, submitting any custom path, from a user without AdminOperationsPermission.
+            assertFalse(isFileRootChangeAuthorizedOrNoChange(false, true, null, "/some/path"));
+        }
+
+        @Test
+        public void customRootRequiresAdminOpsPermissionForDifferentPath()
+        {
+            assertFalse(isFileRootChangeAuthorizedOrNoChange(false, false, "/existing/path", "/attacker/path"));
+        }
+
+        @Test
+        public void customRootResubmissionOfSamePathIsAllowed()
+        {
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(false, false, "/existing/path", "/existing/path"));
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(false, false, "/Existing/Path", "/existing/path"));
+        }
+
+        @Test
+        public void noRequestedRootOnDefaultRootIsAllowed()
+        {
+            // No custom root requested and none currently exists -- nothing to protect.
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(false, true, null, null));
+        }
+
+        @Test
+        public void clearingAnExistingCustomRootRequiresAdminOpsPermission()
+        {
+            // A request that omits the root (e.g. a non-ops admin's disabled form fields not being submitted)
+            // must not be able to silently clear an existing custom root back to default.
+            assertFalse(isFileRootChangeAuthorizedOrNoChange(false, false, "/existing/path", null));
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(true, false, "/existing/path", null));
+        }
+
+        @Test
+        public void revertingCustomRootToSiteDefaultRequiresAdminOpsPermission()
+        {
+            // Selecting the site default root while a custom root (file path or cloud) is in effect relocates the
+            // folder's file storage, so it needs the same elevated permission as setting a custom root.
+            assertFalse(isFileRootChangeAuthorizedOrNoChange(false, false, "/existing/path", null));
+            assertFalse(isFileRootChangeAuthorizedOrNoChange(false, false, "myCloudStore", null));
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(true, false, "myCloudStore", null));
+            // Already on the default root (e.g. re-enabling file sharing from the disabled state) is a no-op.
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(false, true, null, null));
+        }
+
+        @Test
+        public void adminOpsPermissionIsAlwaysAllowed()
+        {
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(true, true, null, "/some/path"));
+            assertTrue(isFileRootChangeAuthorizedOrNoChange(true, false, "/existing/path", "/attacker/path"));
+        }
+    }
+
     public static class ModuleForm
     {
         private String _name;