mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Check correct permissions when resharing 

Fixes #22675

Since we only get a share id we do not know the path for the sharer.
Now if we edit a share we start searching for shares for that user of
that node. And deduce the permissions that way.

* Intergration test added
* Fix unit tests
This commit is contained in:
Roeland Jago Douma 2016-02-29 19:12:19 +01:00
parent a38e8b6436
commit 8924b0a0dc
3 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
apps/files_sharing/api/share20ocs.php
View File

@ -594,6 +594,22 @@ class Share20OCS {
}
}
if ($permissions !== null) {
/* Check if this is an incomming share */
$incomingShares = $this->shareManager->getSharedWith($this->currentUser->getUID(), \OCP\Share::SHARE_TYPE_USER, $share->getNode(), -1, 0);
$incomingShares = array_merge($incomingShares, $this->shareManager->getSharedWith($this->currentUser->getUID(), \OCP\Share::SHARE_TYPE_GROUP, $share->getNode(), -1, 0));
if (!empty($incomingShares)) {
$maxPermissions = 0;
foreach ($incomingShares as $incomingShare) {
$maxPermissions |= $incomingShare->getPermissions();
}
if ($share->getPermissions() & ~$maxPermissions) {
return new \OC_OCS_Result(null, 404, 'Cannot increase permissions');
}
}
}
try {

4
apps/files_sharing/tests/api/share20ocstest.php
View File

@ -1433,6 +1433,8 @@ class Share20OCSTest extends \Test\TestCase {
})
)->will($this->returnArgument(0));
$this->shareManager->method('getSharedWith')->willReturn([]);
$expected = new \OC_OCS_Result(null);
$result = $ocs->updateShare(42);
@ -1498,6 +1500,8 @@ class Share20OCSTest extends \Test\TestCase {
})
)->will($this->returnArgument(0));
$this->shareManager->method('getSharedWith')->willReturn([]);
$expected = new \OC_OCS_Result(null);
$result = $ocs->updateShare(42);

21
build/integration/features/sharing-v1.feature
View File

@ -526,3 +526,24 @@ Feature: sharing
When Updating last share with
| permissions | 1 |
Then the OCS status code should be "100"
Scenario: Do not allow reshare to exceed permissions
Given user "user0" exists
And user "user1" exists
And user "user2" exists
And user "user0" created a folder "/TMP"
And As an "user0"
And creating a share with
| path | /TMP |
| shareType | 0 |
| shareWith | user1 |
| permissions | 21 |
And As an "user1"
And creating a share with
| path | /TMP |
| shareType | 0 |
| shareWith | user2 |
| permissions | 21 |
When Updating last share with
| permissions | 31 |
Then the OCS status code should be "404"