diff options
| author | Bjoern Schiessle <bjoern@schiessle.org> | 2016-06-08 14:59:06 +0200 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2016-06-09 15:15:17 +0200 |
| commit | 66d853680ccc8f579a4b80c85376299b9b98b73b (patch) | |
| tree | 4a651d75414082aee902074b27e5cf8b0e20d035 /apps/dav | |
| parent | bb54ab0db8bfa1ea62bfa2404cb084a9a68d6e20 (diff) | |
| download | nextcloud-server-66d853680ccc8f579a4b80c85376299b9b98b73b.tar.gz nextcloud-server-66d853680ccc8f579a4b80c85376299b9b98b73b.zip | |
block webdav access if share is not readable
Diffstat (limited to 'apps/dav')
| -rw-r--r-- | apps/dav/appinfo/v1/publicwebdav.php | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/apps/dav/appinfo/v1/publicwebdav.php b/apps/dav/appinfo/v1/publicwebdav.php index c6aaab2712f..c6c319aa36d 100644 --- a/apps/dav/appinfo/v1/publicwebdav.php +++ b/apps/dav/appinfo/v1/publicwebdav.php @@ -67,8 +67,13 @@ $server = $serverFactory->createServer($baseuri, $requestUri, $authBackend, func $share = $authBackend->getShare(); $owner = $share->getShareOwner(); $isWritable = $share->getPermissions() & (\OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_CREATE); + $isReadable = $share->getPermissions() & \OCP\Constants::PERMISSION_READ; $fileId = $share->getNodeId(); + if (!$isReadable) { + return false; + } + if (!$isWritable) { \OC\Files\Filesystem::addStorageWrapper('readonly', function ($mountPoint, $storage) { return new \OC\Files\Storage\Wrapper\PermissionsMask(array('storage' => $storage, 'mask' => \OCP\Constants::PERMISSION_READ + \OCP\Constants::PERMISSION_SHARE)); |