From f41c8c00894ebd687e60731e673140c8f5bda320 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 26 Aug 2016 15:51:18 +0200
Subject: [PATCH] Check if the file isReadable() before sending a (cached)
 preview

---
 core/ajax/preview.php   | 2 ++
 lib/private/Preview.php | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/core/ajax/preview.php b/core/ajax/preview.php
index 2894efdc8e..6cfba6aef3 100644
--- a/core/ajax/preview.php
+++ b/core/ajax/preview.php
@@ -53,6 +53,8 @@ $info = \OC\Files\Filesystem::getFileInfo($file);
 
 if (!$info instanceof OCP\Files\FileInfo || !$always && !\OC::$server->getPreviewManager()->isAvailable($info)) {
 	\OC_Response::setStatus(404);
+} else if (!$info->isReadable()) {
+	\OC_Response::setStatus(403);
 } else {
 	$preview = new \OC\Preview(\OC_User::getUser(), 'files');
 	$preview->setFile($file, $info);
diff --git a/lib/private/Preview.php b/lib/private/Preview.php
index 70b000a30e..67838a8d4a 100644
--- a/lib/private/Preview.php
+++ b/lib/private/Preview.php
@@ -763,7 +763,7 @@ class Preview {
 
 		$this->preview = null;
 		$fileInfo = $this->getFileInfo();
-		if ($fileInfo === null || $fileInfo === false) {
+		if ($fileInfo === null || $fileInfo === false || !$fileInfo->isReadable()) {
 			return new \OC_Image();
 		}