--- a/video.py	Tue Dec 03 19:28:11 2024 -0800
+++ b/video.py	Wed Dec 04 21:50:16 2024 -0800
@@ -30,7 +30,20 @@
 
 
 async def videos(req: Request) -> JSONResponse:
-    subdir = req.query_params.get('subdir', '/')  # danger user input
+    subdir = req.query_params.get('subdir', '/')
+    if not subdir.endswith('/'):
+        # raise ValueError(f'not a dir {subdir=}')
+        # ok we'll list the parent dir underneath
+        subdir = '/'.join(subdir.split('/')[:-1]) # todo move to FE
+    else:
+        subdir = subdir[:-1]
+    if subdir=="":
+        subdir = "./"
+    if not (subdir.startswith('/') or subdir=='./'):
+        raise ValueError(f'not a dir {subdir=}')
+    subdir = subdir[1:]
+    log.debug(f'videos request corrected to: {subdir=}')
+    
     vfInDir = store.findInDir(subdir)
     return JSONResponse({
         "videos": [{