fix(share): Ensure unique share tokens

- check for token collisions and retry up to three times.
- throw after 3 attempts without finding a unique token.

Signed-off-by: ernolf <raphael.gradenwitz@googlemail.com>

diff --git a/lib/private/Share20/Manager.php b/lib/private/Share20/Manager.php
index 16ada8c6c7a18ac6dadb0eab093905919da1c840..bd35729cb3c8e7f762597b093df507c6f39b23ca 100644 (file)
--- a/lib/private/Share20/Manager.php
+++ b/lib/private/Share20/Manager.php
@@ -697,13 +697,25 @@ class Manager implements IManager {
                                $this->linkCreateChecks($share);
                                $this->setLinkParent($share);
 
-                               // For now ignore a set token.
-                               $share->setToken(
-                                       $this->secureRandom->generate(
+                               for ($i = 0; $i <= 3; $i++) {
+                                       $token = $this->secureRandom->generate(
                                                \OC\Share\Constants::TOKEN_LENGTH,
                                                \OCP\Security\ISecureRandom::CHAR_HUMAN_READABLE
-                                       )
-                               );
+                                       );
+
+                                       try {
+                                               $this->getShareByToken($token);
+                                       } catch (\OCP\Share\Exceptions\ShareNotFound $e) {
+                                               // Set the unique token
+                                               $share->setToken($token);
+                                               break;
+                                       }
+
+                                       // Abort after 3 failed attempts
+                                       if ($i >= 3) {
+                                               throw new \Exception('Unable to generate a unique share token after 3 attempts.');
+                                       }
+                               }
 
                                // Verify the expiration date
                                $share = $this->validateExpirationDateLink($share);