From 533fdb4075a1dc41ba10bdbc3782d92ff088bbbb Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Thu, 17 Mar 2016 11:35:31 +0100 Subject: [PATCH] Set proper public webdav permissions when public upload disabled Fixes #23325 It can happen that a user shares a folder with public upload. And some time later the admin disables public upload on the server. To make sure this is handled correctly we need to check the config value and reduce the permissions. Fix is kept small to be easy backportable. --- apps/dav/lib/connector/publicauth.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/dav/lib/connector/publicauth.php b/apps/dav/lib/connector/publicauth.php index 3d800e8800..f069a214fe 100644 --- a/apps/dav/lib/connector/publicauth.php +++ b/apps/dav/lib/connector/publicauth.php @@ -61,6 +61,11 @@ class PublicAuth extends \Sabre\DAV\Auth\Backend\AbstractBasic { return false; } + if ((int)$linkItem['share_type'] === \OCP\Share::SHARE_TYPE_LINK && + $this->config->getAppValue('core', 'shareapi_allow_public_upload', 'yes') !== 'yes') { + $this->share['permissions'] &= ~(\OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE); + } + // check if the share is password protected if (isset($linkItem['share_with'])) { if ($linkItem['share_type'] == \OCP\Share::SHARE_TYPE_LINK) {