diff options
| author | Julius Härtl <jus@bitgrid.net> | 2022-10-25 09:15:39 +0200 |
|---|---|---|
| committer | backportbot-nextcloud[bot] <backportbot-nextcloud[bot]@users.noreply.github.com> | 2022-10-26 13:25:13 +0000 |
| commit | bc3572ebc3b3d423828eddb7f0f234ce09bf442e (patch) | |
| tree | 090d7ff8c93b5adfd9148879f78025def2b7c59b /core | |
| parent | 7eece690c9193d2bbfcd701ad68c29d408330ee1 (diff) | |
| download | nextcloud-server-bc3572ebc3b3d423828eddb7f0f234ce09bf442e.tar.gz nextcloud-server-bc3572ebc3b3d423828eddb7f0f234ce09bf442e.zip | |
Check share attributes on preview endpoints
Signed-off-by: Julius Härtl <jus@bitgrid.net>
Diffstat (limited to 'core')
| -rw-r--r-- | core/Controller/PreviewController.php | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/core/Controller/PreviewController.php b/core/Controller/PreviewController.php index 30b0a45c13d..db6cba15359 100644 --- a/core/Controller/PreviewController.php +++ b/core/Controller/PreviewController.php @@ -27,6 +27,7 @@ declare(strict_types=1); */ namespace OC\Core\Controller; +use OCA\Files_Sharing\SharedStorage; use OCP\AppFramework\Controller; use OCP\AppFramework\Http; use OCP\AppFramework\Http\DataResponse; @@ -165,6 +166,16 @@ class PreviewController extends Controller { return new DataResponse([], Http::STATUS_FORBIDDEN); } + $storage = $node->getStorage(); + if ($storage->instanceOfStorage(SharedStorage::class)) { + /** @var SharedStorage $storage */ + $share = $storage->getShare(); + $attributes = $share->getAttributes(); + if ($attributes !== null && $attributes->getAttribute('permissions', 'download') === false) { + return new DataResponse([], Http::STATUS_FORBIDDEN); + } + } + try { $f = $this->preview->getPreview($node, $x, $y, !$a, $mode); $response = new FileDisplayResponse($f, Http::STATUS_OK, [ |