diff options
| author | Morris Jobke <morris.jobke@gmail.com> | 2013-10-17 03:50:26 -0700 |
|---|---|---|
| committer | Morris Jobke <morris.jobke@gmail.com> | 2013-10-17 03:50:26 -0700 |
| commit | ea4f6e2431f8545a71022916ac530d994803e99c (patch) | |
| tree | 3d9efeee9b9e1af909183e43609874fc1c08ab09 | |
| parent | fe1df961c14079313ff7fed591283e0b9e199f38 (diff) | |
| parent | 9cfb438ff7fd24ef5c81c4f2e075789d320016e2 (diff) | |
| download | nextcloud-server-ea4f6e2431f8545a71022916ac530d994803e99c.tar.gz nextcloud-server-ea4f6e2431f8545a71022916ac530d994803e99c.zip | |
Merge pull request #5378 from owncloud/files-permissionsafteruploadfix
Fixed upload permissions distinction between public and logged in upload
| -rw-r--r-- | apps/files/ajax/upload.php | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/apps/files/ajax/upload.php b/apps/files/ajax/upload.php index 2c1be428e84..38c2a053a9e 100644 --- a/apps/files/ajax/upload.php +++ b/apps/files/ajax/upload.php @@ -7,6 +7,8 @@ OCP\JSON::setContentTypeHeader('text/plain'); // If not, check the login. // If no token is sent along, rely on login only +$allowedPermissions = OCP\PERMISSION_ALL; + $l = OC_L10N::get('files'); if (empty($_POST['dirToken'])) { // The standard case, files are uploaded through logged in users :) @@ -17,6 +19,9 @@ if (empty($_POST['dirToken'])) { die(); } } else { + // return only read permissions for public upload + $allowedPermissions = OCP\PERMISSION_READ; + $linkItem = OCP\Share::getShareByToken($_POST['dirToken']); if ($linkItem === false) { OCP\JSON::error(array('data' => array_merge(array('message' => $l->t('Invalid Token'))))); @@ -130,7 +135,7 @@ if (strpos($dir, '..') === false) { 'originalname' => $files['tmp_name'][$i], 'uploadMaxFilesize' => $maxUploadFileSize, 'maxHumanFilesize' => $maxHumanFileSize, - 'permissions' => $meta['permissions'] & OCP\PERMISSION_READ + 'permissions' => $meta['permissions'] & $allowedPermissions ); } @@ -156,7 +161,7 @@ if (strpos($dir, '..') === false) { 'originalname' => $files['tmp_name'][$i], 'uploadMaxFilesize' => $maxUploadFileSize, 'maxHumanFilesize' => $maxHumanFileSize, - 'permissions' => $meta['permissions'] & OCP\PERMISSION_READ + 'permissions' => $meta['permissions'] & $allowedPermissions ); } } |