From 37d0fd109a921d760d621a4f0a11cf05c9c7211f Mon Sep 17 00:00:00 2001 From: Louis Chemineau Date: Tue, 13 Feb 2024 12:51:01 +0100 Subject: [PATCH] Check node permissions when restoring a version Signed-off-by: Louis Chemineau --- apps/files_versions/lib/Versions/LegacyVersionsBackend.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php index fe7f41e8155..a591c2ae61f 100644 --- a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php +++ b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php @@ -178,6 +178,10 @@ class LegacyVersionsBackend implements IVersionBackend, INameableVersionBackend, } public function rollback(IVersion $version) { + if (!$this->currentUserHasPermissions($version, \OCP\Constants::PERMISSION_UPDATE)) { + throw new Forbidden('You cannot restore this version because you do not have update permissions on the source file.'); + } + return Storage::rollback($version->getVersionPath(), $version->getRevisionId(), $version->getUser()); } -- 2.39.5