Allow increasing permissions for share owner

In some cases, the owner of the share is also recipient through a group
share. The owner must still be able to increase permissions in that
situation.

diff --git a/apps/files_sharing/lib/API/Share20OCS.php b/apps/files_sharing/lib/API/Share20OCS.php
index 593e9d877c70d2758b391b5f3edec750050b5966..23ebe4871ccef8f4245d92af986cb4d0e7ecc5c4 100644 (file)
--- a/apps/files_sharing/lib/API/Share20OCS.php
+++ b/apps/files_sharing/lib/API/Share20OCS.php
@@ -668,7 +668,7 @@ class Share20OCS {
                        }
                }
 
-               if ($permissions !== null) {
+               if ($permissions !== null && $share->getShareOwner() !== $this->currentUser->getUID()) {
                        /* Check if this is an incomming share */
                        $incomingShares = $this->shareManager->getSharedWith($this->currentUser->getUID(), \OCP\Share::SHARE_TYPE_USER, $share->getNode(), -1, 0);
                        $incomingShares = array_merge($incomingShares, $this->shareManager->getSharedWith($this->currentUser->getUID(), \OCP\Share::SHARE_TYPE_GROUP, $share->getNode(), -1, 0));

diff --git a/apps/files_sharing/tests/API/Share20OCSTest.php b/apps/files_sharing/tests/API/Share20OCSTest.php
index 5486a83c159b8c6fabee35afd7575b2fa2cfb0f8..90986fc0c349a36acc990aeb7bdb9a34e2806b7d 100644 (file)
--- a/apps/files_sharing/tests/API/Share20OCSTest.php
+++ b/apps/files_sharing/tests/API/Share20OCSTest.php
@@ -1766,6 +1766,114 @@ class Share20OCSTest extends \Test\TestCase {
                $this->assertEquals($expected->getData(), $result->getData());
        }
 
+       public function testUpdateShareCannotIncreasePermissions() {
+               $ocs = $this->mockFormatShare();
+
+               $date = new \DateTime('2000-01-01');
+
+               $folder = $this->getMock('\OCP\Files\Folder');
+
+               $share = \OC::$server->getShareManager()->newShare();
+               $share
+                       ->setId(42)
+                       ->setSharedBy($this->currentUser->getUID())
+                       ->setShareOwner('anotheruser')
+                       ->setShareType(\OCP\Share::SHARE_TYPE_GROUP)
+                       ->setSharedWith('group1')
+                       ->setPermissions(\OCP\Constants::PERMISSION_READ)
+                       ->setNode($folder);
+
+               // note: updateShare will modify the received instance but getSharedWith will reread from the database,
+               // so their values will be different
+               $incomingShare = \OC::$server->getShareManager()->newShare();
+               $incomingShare
+                       ->setId(42)
+                       ->setSharedBy($this->currentUser->getUID())
+                       ->setShareOwner('anotheruser')
+                       ->setShareType(\OCP\Share::SHARE_TYPE_GROUP)
+                       ->setSharedWith('group1')
+                       ->setPermissions(\OCP\Constants::PERMISSION_READ)
+                       ->setNode($folder);
+
+               $this->request
+                       ->method('getParam')
+                       ->will($this->returnValueMap([
+                               ['permissions', null, '31'],
+                       ]));
+
+               $this->shareManager->method('getShareById')->with('ocinternal:42')->willReturn($share);
+
+               $this->shareManager->expects($this->any(0))
+                       ->method('getSharedWith')
+                       ->will($this->returnValueMap([
+                               ['currentUser', \OCP\Share::SHARE_TYPE_USER, $share->getNode(), -1, 0, []],
+                               ['currentUser', \OCP\Share::SHARE_TYPE_GROUP, $share->getNode(), -1, 0, [$incomingShare]]
+                       ]));
+
+               $this->shareManager->expects($this->never())->method('updateShare');
+
+               $expected = new \OC_OCS_Result(null, 404, 'Cannot increase permissions');
+               $result = $ocs->updateShare(42);
+
+               $this->assertEquals($expected->getMeta(), $result->getMeta());
+               $this->assertEquals($expected->getData(), $result->getData());
+       }
+
+       public function testUpdateShareCanIncreasePermissionsIfOwner() {
+               $ocs = $this->mockFormatShare();
+
+               $date = new \DateTime('2000-01-01');
+
+               $folder = $this->getMock('\OCP\Files\Folder');
+
+               $share = \OC::$server->getShareManager()->newShare();
+               $share
+                       ->setId(42)
+                       ->setSharedBy($this->currentUser->getUID())
+                       ->setShareOwner($this->currentUser->getUID())
+                       ->setShareType(\OCP\Share::SHARE_TYPE_GROUP)
+                       ->setSharedWith('group1')
+                       ->setPermissions(\OCP\Constants::PERMISSION_READ)
+                       ->setNode($folder);
+
+               // note: updateShare will modify the received instance but getSharedWith will reread from the database,
+               // so their values will be different
+               $incomingShare = \OC::$server->getShareManager()->newShare();
+               $incomingShare
+                       ->setId(42)
+                       ->setSharedBy($this->currentUser->getUID())
+                       ->setShareOwner($this->currentUser->getUID())
+                       ->setShareType(\OCP\Share::SHARE_TYPE_GROUP)
+                       ->setSharedWith('group1')
+                       ->setPermissions(\OCP\Constants::PERMISSION_READ)
+                       ->setNode($folder);
+
+               $this->request
+                       ->method('getParam')
+                       ->will($this->returnValueMap([
+                               ['permissions', null, '31'],
+                       ]));
+
+               $this->shareManager->method('getShareById')->with('ocinternal:42')->willReturn($share);
+
+               $this->shareManager->expects($this->any(0))
+                       ->method('getSharedWith')
+                       ->will($this->returnValueMap([
+                               ['currentUser', \OCP\Share::SHARE_TYPE_USER, $share->getNode(), -1, 0, []],
+                               ['currentUser', \OCP\Share::SHARE_TYPE_GROUP, $share->getNode(), -1, 0, [$incomingShare]]
+                       ]));
+
+               $this->shareManager->expects($this->once())
+                       ->method('updateShare')
+                       ->with($share)
+                       ->willReturn($share);
+
+               $expected = new \OC_OCS_Result();
+               $result = $ocs->updateShare(42);
+
+               $this->assertEquals($expected->getMeta(), $result->getMeta());
+               $this->assertEquals($expected->getData(), $result->getData());
+       }
        public function dataFormatShare() {
                $file = $this->getMockBuilder('\OCP\Files\File')->getMock();
                $folder = $this->getMockBuilder('\OCP\Files\Folder')->getMock();