fix(workflow): Check tag attribute

Signed-off-by: Joas Schilling <coding@schilljs.com>

diff --git a/apps/workflowengine/lib/Check/FileSystemTags.php b/apps/workflowengine/lib/Check/FileSystemTags.php
index 944552bef595889890df652853f44da055c4615c..86492c7a85ac25d6ffb8bffa4e8a139bebc5b9e8 100644 (file)
--- a/apps/workflowengine/lib/Check/FileSystemTags.php
+++ b/apps/workflowengine/lib/Check/FileSystemTags.php
@@ -25,7 +25,10 @@ use OCA\Files_Sharing\SharedStorage;
 use OCA\WorkflowEngine\Entity\File;
 use OCP\Files\Cache\ICache;
 use OCP\Files\IHomeStorage;
+use OCP\IGroupManager;
 use OCP\IL10N;
+use OCP\IUser;
+use OCP\IUserSession;
 use OCP\SystemTag\ISystemTagManager;
 use OCP\SystemTag\ISystemTagObjectMapper;
 use OCP\SystemTag\TagNotFoundException;
@@ -50,16 +53,23 @@ class FileSystemTags implements ICheck, IFileCheck {
 
        /** @var ISystemTagObjectMapper */
        protected $systemTagObjectMapper;
-
-       /**
-        * @param IL10N $l
-        * @param ISystemTagManager $systemTagManager
-        * @param ISystemTagObjectMapper $systemTagObjectMapper
-        */
-       public function __construct(IL10N $l, ISystemTagManager $systemTagManager, ISystemTagObjectMapper $systemTagObjectMapper) {
+       /** @var IUserSession */
+       protected $userSession;
+       /** @var IGroupManager */
+       protected $groupManager;
+
+       public function __construct(
+               IL10N $l,
+               ISystemTagManager $systemTagManager,
+               ISystemTagObjectMapper $systemTagObjectMapper,
+               IUserSession $userSession,
+               IGroupManager $groupManager
+       ) {
                $this->l = $l;
                $this->systemTagManager = $systemTagManager;
                $this->systemTagObjectMapper = $systemTagObjectMapper;
+               $this->userSession = $userSession;
+               $this->groupManager = $groupManager;
        }
 
        /**
@@ -83,7 +93,18 @@ class FileSystemTags implements ICheck, IFileCheck {
                }
 
                try {
-                       $this->systemTagManager->getTagsByIds($value);
+                       $tags = $this->systemTagManager->getTagsByIds($value);
+
+                       $user = $this->userSession->getUser();
+                       $isAdmin = $user instanceof IUser && $this->groupManager->isAdmin($user->getUID());
+
+                       if (!$isAdmin) {
+                               foreach ($tags as $tag) {
+                                       if (!$tag->isUserVisible()) {
+                                               throw new \UnexpectedValueException($this->l->t('The given tag id is invalid'), 4);
+                                       }
+                               }
+                       }
                } catch (TagNotFoundException $e) {
                        throw new \UnexpectedValueException($this->l->t('The given tag id is invalid'), 2);
                } catch (\InvalidArgumentException $e) {