mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #19764 from nextcloud/fix/transfer-ownerhip-owner-check 

Do not allow transfer ownership when the user isn't the owner
This commit is contained in:
Roeland Jago Douma 2020-03-03 20:20:43 +01:00 committed by GitHub
parent b57ffe8d75 68b764bb0f
commit 65b75c8bba
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apps/files/js/dist/personal-settings.js vendored
View File

File diff suppressed because one or more lines are too long

2
apps/files/js/dist/personal-settings.js.map vendored
View File

File diff suppressed because one or more lines are too long

4
apps/files/lib/Controller/TransferOwnershipController.php
View File

@ -96,6 +96,10 @@ class TransferOwnershipController extends OCSController {
return new DataResponse([], Http::STATUS_BAD_REQUEST); return new DataResponse([], Http::STATUS_BAD_REQUEST);
} }
if ($node->getOwner()->getUID() !== $this->userId) {
return new DataResponse([], Http::STATUS_FORBIDDEN);
}
$transferOwnership = new TransferOwnershipEntity(); $transferOwnership = new TransferOwnershipEntity();
$transferOwnership->setSourceUser($this->userId); $transferOwnership->setSourceUser($this->userId);
$transferOwnership->setTargetUser($recipient); $transferOwnership->setTargetUser($recipient);

6
apps/files/src/components/TransferOwnershipDialogue.vue
View File

@ -215,7 +215,11 @@ export default {
.catch(error => { .catch(error => {
logger.error('Could not send ownership transfer request', { error }) logger.error('Could not send ownership transfer request', { error })
this.submitError = error.message || t('files', 'Unknown error') if (error?.response?.status === 403) {
this.submitError = t('files', 'Cannot transfter ownership of a file or folder you don\'t own')
} else {
this.submitError = error.message || t('files', 'Unknown error')
}
}) })
}, },
}, },