diff options
| author | Vincent Petry <pvince81@owncloud.com> | 2014-01-21 11:08:58 -0800 |
|---|---|---|
| committer | Vincent Petry <pvince81@owncloud.com> | 2014-01-21 11:08:58 -0800 |
| commit | 9851727b0d231e2c0af79a704af76d262d21f19d (patch) | |
| tree | 8ef2b1662295df1b4f9bc1fe4faa3bfea8109f65 /lib | |
| parent | 3b7fea25a30aa7dc590d90c5c91147ae9d94ba13 (diff) | |
| parent | 9bab05fd45434a62c9c017d73d74c1fe1928ead0 (diff) | |
| download | nextcloud-server-9851727b0d231e2c0af79a704af76d262d21f19d.tar.gz nextcloud-server-9851727b0d231e2c0af79a704af76d262d21f19d.zip | |
Merge pull request #6856 from owncloud/fixing-gallery-password-protected-access-master
adding password protection check to getShareByToken()
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/public/share.php | 45 |
1 files changed, 41 insertions, 4 deletions
diff --git a/lib/public/share.php b/lib/public/share.php index eb1dd8d1c95..f832d04a70f 100644 --- a/lib/public/share.php +++ b/lib/public/share.php @@ -347,20 +347,29 @@ class Share { } /** - * Get the item shared by a token - * @param string token - * @return Item + * Based on the given token the share information will be returned - password protected shares will be verified + * @param string $token + * @return array | bool false will be returned in case the token is unknown or unauthorized */ - public static function getShareByToken($token) { + public static function getShareByToken($token, $checkPasswordProtection = true) { $query = \OC_DB::prepare('SELECT * FROM `*PREFIX*share` WHERE `token` = ?', 1); $result = $query->execute(array($token)); if (\OC_DB::isError($result)) { \OC_Log::write('OCP\Share', \OC_DB::getErrorMessage($result) . ', token=' . $token, \OC_Log::ERROR); } $row = $result->fetchRow(); + if ($row === false) { + return false; + } if (is_array($row) and self::expireItem($row)) { return false; } + + // password protected shares need to be authenticated + if ($checkPasswordProtection && !\OCP\Share::checkPasswordProtectedShare($row)) { + return false; + } + return $row; } @@ -1888,6 +1897,34 @@ class Share { } } + /** + * In case a password protected link is not yet authenticated this function will return false + * + * @param array $linkItem + * @return bool + */ + public static function checkPasswordProtectedShare(array $linkItem) { + if (!isset($linkItem['share_with'])) { + return true; + } + if (!isset($linkItem['share_type'])) { + return true; + } + if (!isset($linkItem['id'])) { + return true; + } + + if ($linkItem['share_type'] != \OCP\Share::SHARE_TYPE_LINK) { + return true; + } + + if ( \OC::$session->exists('public_link_authenticated') + && \OC::$session->get('public_link_authenticated') === $linkItem['id'] ) { + return true; + } + + return false; + } } /** |