diff --git a/apps/dav/appinfo/v1/publicwebdav.php b/apps/dav/appinfo/v1/publicwebdav.php index 6ddb570aca..b0ee264aac 100644 --- a/apps/dav/appinfo/v1/publicwebdav.php +++ b/apps/dav/appinfo/v1/publicwebdav.php @@ -46,7 +46,9 @@ $serverFactory = new OCA\DAV\Connector\Sabre\ServerFactory( $requestUri = \OC::$server->getRequest()->getRequestUri(); -$server = $serverFactory->createServer($baseuri, $requestUri, $authBackend, function () use ($authBackend) { +$linkCheckPlugin = new \OCA\DAV\Files\Sharing\PublicLinkCheckPlugin(); + +$server = $serverFactory->createServer($baseuri, $requestUri, $authBackend, function (\Sabre\DAV\Server $server) use ($authBackend, $linkCheckPlugin) { $isAjax = (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] === 'XMLHttpRequest'); if (OCA\Files_Sharing\Helper::isOutgoingServer2serverShareEnabled() === false && !$isAjax) { // this is what is thrown when trying to access a non-existing share @@ -68,9 +70,13 @@ $server = $serverFactory->createServer($baseuri, $requestUri, $authBackend, func OC_Util::setupFS($owner); $ownerView = \OC\Files\Filesystem::getView(); $path = $ownerView->getPath($fileId); + $fileInfo = $ownerView->getFileInfo($path); + $linkCheckPlugin->setFileInfo($fileInfo); return new \OC\Files\View($ownerView->getAbsolutePath($path)); }); +$server->addPlugin($linkCheckPlugin); + // And off we go! $server->exec(); diff --git a/apps/dav/lib/connector/sabre/serverfactory.php b/apps/dav/lib/connector/sabre/serverfactory.php index 9a828787a0..8253948d96 100644 --- a/apps/dav/lib/connector/sabre/serverfactory.php +++ b/apps/dav/lib/connector/sabre/serverfactory.php @@ -118,7 +118,7 @@ class ServerFactory { $userFolder = \OC::$server->getUserFolder(); /** @var \OC\Files\View $view */ - $view = $viewCallBack(); + $view = $viewCallBack($server); $rootInfo = $view->getFileInfo(''); // Create ownCloud Dir diff --git a/apps/dav/lib/files/sharing/publiclinkcheckplugin.php b/apps/dav/lib/files/sharing/publiclinkcheckplugin.php new file mode 100644 index 0000000000..bbb5c61120 --- /dev/null +++ b/apps/dav/lib/files/sharing/publiclinkcheckplugin.php @@ -0,0 +1,63 @@ + + * + * @copyright Copyright (c) 2015, ownCloud, Inc. + * @license AGPL-3.0 + * + * This code is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License, version 3, + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License, version 3, + * along with this program. If not, see + * + */ + +namespace OCA\DAV\Files\Sharing; + +use OCP\Files\FileInfo; +use Sabre\DAV\Exception\NotFound; +use Sabre\DAV\ServerPlugin; +use Sabre\HTTP\RequestInterface; +use Sabre\HTTP\ResponseInterface; + +/** + * Verify that the public link share is valid + */ +class PublicLinkCheckPlugin extends ServerPlugin { + /** + * @var FileInfo + */ + private $fileInfo; + + /** + * @param FileInfo $fileInfo + */ + public function setFileInfo($fileInfo) { + $this->fileInfo = $fileInfo; + } + + /** + * This initializes the plugin. + * + * @param \Sabre\DAV\Server $server Sabre server + * + * @return void + */ + public function initialize(\Sabre\DAV\Server $server) { + $server->on('beforeMethod', [$this, 'beforeMethod']); + } + + public function beforeMethod(RequestInterface $request, ResponseInterface $response){ + // verify that the owner didn't have his share permissions revoked + if ($this->fileInfo && !$this->fileInfo->isShareable()) { + throw new NotFound(); + } + } +}