Merge pull request #16176 from owncloud/fix-provisioning-api-set-quota

Validate the quota value to be a correct value

2 files changed, 31 insertions, 8 deletions

diff --git a/apps/provisioning_api/lib/users.php b/apps/provisioning_api/lib/users.php
index 505a141c032..43cf22b071b 100644
--- a/apps/provisioning_api/lib/users.php
+++ b/apps/provisioning_api/lib/users.php
@@ -155,7 +155,14 @@ class Users {
 			case 'quota':
 				$quota = $parameters['_put']['value'];
 				if($quota !== 'none' and $quota !== 'default') {
-					$quota = OC_Helper::computerFileSize($quota);
+					if (is_numeric($quota)) {
+						$quota = floatval($quota);
+					} else {
+						$quota = OC_Helper::computerFileSize($quota);
+					}
+					if ($quota === false) {
+						return new OC_OCS_Result(null, 103, "Invalid quota value {$parameters['_put']['value']}");
+					}
 					if($quota == 0) {
 						$quota = 'default';
 					}else if($quota == -1){
diff --git a/apps/provisioning_api/tests/userstest.php b/apps/provisioning_api/tests/userstest.php
index b7e83a3c4fe..c6a6133b7d2 100644
--- a/apps/provisioning_api/tests/userstest.php
+++ b/apps/provisioning_api/tests/userstest.php
@@ -187,20 +187,36 @@ class UsersTest extends TestCase {
 
 	}
 
-	public function testEditOwnQuota() {
+	/**
+	 * @dataProvider providesQuotas
+	 * @param $expected
+	 * @param $quota
+	 */
+	public function testEditOwnQuota($expected, $quota) {
 		$user = $this->generateUsers();
+		\OC_Group::addToGroup($user, 'admin');
 		\OC_User::setUserId($user);
 		$result = \OCA\provisioning_API\Users::editUser(
-			array(
+			[
 				'userid' => $user,
-				'_put' => array(
+				'_put' => [
 					'key' => 'quota',
-					'value' => '20G',
-					),
-				)
+					'value' => $quota,
+				],
+			]
 			);
 		$this->assertInstanceOf('OC_OCS_Result', $result);
-		$this->assertFalse($result->succeeded());
+		$this->assertEquals($expected, $result->succeeded());
+	}
+
+	public function providesQuotas() {
+		return [
+			[true, '20G'],
+			[true, '1234567'],
+			[true, 'none'],
+			[true, 'default'],
+			[false, 'qwertzu'],
+		];
 	}
 
 	public function testAdminEditOwnQuota() {