Fix for broken ajax/share.php endpoint

Even more code mess :(
All tests pass again. But I'm really not happy with this endpoint.

1 files changed, 16 insertions, 8 deletions

diff --git a/lib/private/share/share.php b/lib/private/share/share.php
index 1b31df554cb..097c5a14b9f 100644
--- a/lib/private/share/share.php
+++ b/lib/private/share/share.php
@@ -597,11 +597,12 @@ class Share extends Constants {
 	 * @param int $permissions CRUDS
 	 * @param string $itemSourceName
 	 * @param \DateTime $expirationDate
+	 * @param bool $passwordChanged
 	 * @return boolean|string Returns true on success or false on failure, Returns token on success for links
 	 * @throws \OC\HintException when the share type is remote and the shareWith is invalid
 	 * @throws \Exception
 	 */
-	public static function shareItem($itemType, $itemSource, $shareType, $shareWith, $permissions, $itemSourceName = null, \DateTime $expirationDate = null) {
+	public static function shareItem($itemType, $itemSource, $shareType, $shareWith, $permissions, $itemSourceName = null, \DateTime $expirationDate = null, $passwordChanged = null) {
 
 		$backend = self::getBackend($itemType);
 		$l = \OC::$server->getL10N('lib');
@@ -775,19 +776,26 @@ class Share extends Constants {
 					$updateExistingShare = true;
 				}
 
-				// Generate hash of password if the password was changed on the client
-				if (isset($shareWith['passwordChanged']) && $shareWith['passwordChanged'] === 'true') {
-					$shareWith = $shareWith['password'];
+				if ($passwordChanged === null) {
+					// Generate hash of password - same method as user passwords
 					if (is_string($shareWith) && $shareWith !== '') {
 						self::verifyPassword($shareWith);
 						$shareWith = \OC::$server->getHasher()->hash($shareWith);
+					} else {
+						// reuse the already set password, but only if we change permissions
+						// otherwise the user disabled the password protection
+						if ($checkExists && (int)$permissions !== (int)$oldPermissions) {
+							$shareWith = $checkExists['share_with'];
+						}
 					}
 				} else {
-					// reuse the existing password if it was not updated from the client
-					if ($updateExistingShare) {
+					if ($passwordChanged === true) {
+						if (is_string($shareWith) && $shareWith !== '') {
+							self::verifyPassword($shareWith);
+							$shareWith = \OC::$server->getHasher()->hash($shareWith);
+						}
+					} else if ($updateExistingShare) {
 						$shareWith = $checkExists['share_with'];
-					} else {
-						$shareWith = '';
 					}
 				}