From 395d697598e1642891813dd187024dc4a21ddbf7 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Tue, 20 Nov 2018 19:36:17 +0100 Subject: [PATCH] Handle permission in update of share better Signed-off-by: Roeland Jago Douma --- apps/files_sharing/lib/Controller/ShareAPIController.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/files_sharing/lib/Controller/ShareAPIController.php b/apps/files_sharing/lib/Controller/ShareAPIController.php index 308e7bbb742..1354c90a9f6 100644 --- a/apps/files_sharing/lib/Controller/ShareAPIController.php +++ b/apps/files_sharing/lib/Controller/ShareAPIController.php @@ -773,6 +773,10 @@ class ShareAPIController extends OCSController { throw new OCSNotFoundException($this->l->t('Wrong share ID, share doesn\'t exist')); } + if ($share->getShareOwner() !== $this->currentUser && $share->getSharedBy() !== $this->currentUser) { + throw new OCSForbiddenException('You are not allowed to edit incomming shares'); + } + if ($permissions === null && $password === null && $sendPasswordByTalk === null && $publicUpload === null && $expireDate === null && $note === null) { throw new OCSBadRequestException($this->l->t('Wrong or no update parameter given')); } -- 2.39.5