From 046b8f320f2ce1c37f658130ec84071218262deb Mon Sep 17 00:00:00 2001 From: Louis Chemineau Date: Wed, 21 Feb 2024 14:34:12 +0100 Subject: [PATCH] Check permissions when labeling a version Signed-off-by: Louis Chemineau --- apps/files_versions/lib/Versions/LegacyVersionsBackend.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php index a591c2ae61f..a6bf6c2cb1a 100644 --- a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php +++ b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php @@ -228,6 +228,10 @@ class LegacyVersionsBackend implements IVersionBackend, INameableVersionBackend, } public function setVersionLabel(IVersion $version, string $label): void { + if (!$this->currentUserHasPermissions($version, \OCP\Constants::PERMISSION_UPDATE)) { + throw new Forbidden('You cannot label this version because you do not have update permissions on the source file.'); + } + $versionEntity = $this->versionsMapper->findVersionForFileId( $version->getSourceFile()->getId(), $version->getTimestamp(), -- 2.39.5