Check permissions when labeling a version

Signed-off-by: Louis Chemineau <louis@chmn.me>

diff --git a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php
index a591c2ae61ffeff1ffc106ff61ef4abe1e7fd144..a6bf6c2cb1a894650d91c135cfd2e9963cd23d27 100644 (file)
--- a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php
+++ b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php
@@ -228,6 +228,10 @@ class LegacyVersionsBackend implements IVersionBackend, INameableVersionBackend,
        }
 
        public function setVersionLabel(IVersion $version, string $label): void {
+               if (!$this->currentUserHasPermissions($version, \OCP\Constants::PERMISSION_UPDATE)) {
+                       throw new Forbidden('You cannot label this version because you do not have update permissions on the source file.');
+               }
+
                $versionEntity = $this->versionsMapper->findVersionForFileId(
                        $version->getSourceFile()->getId(),
                        $version->getTimestamp(),