fix(files_sharing): block downloading if neededfix/download-perms

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

1 files changed, 5 insertions, 0 deletions

diff --git a/apps/files_sharing/lib/Controller/ShareController.php b/apps/files_sharing/lib/Controller/ShareController.php
index 1c3c9534dde..cfd9628410e 100644
--- a/apps/files_sharing/lib/Controller/ShareController.php
+++ b/apps/files_sharing/lib/Controller/ShareController.php
@@ -359,6 +359,11 @@ class ShareController extends AuthPublicShareController {
 			return new DataResponse('Share has no read permission');
 		}
 
+		$attributes = $share->getAttributes();
+		if ($attributes?->getAttribute('permissions', 'download') === false) {
+			return new DataResponse('Share has no download permission');
+		}
+
 		if (!$this->validateShare($share)) {
 			throw new NotFoundException();
 		}