diff options
| author | Joas Schilling <coding@schilljs.com> | 2019-07-02 10:22:30 +0200 |
|---|---|---|
| committer | Joas Schilling <coding@schilljs.com> | 2019-07-03 14:00:13 +0200 |
| commit | e4addbae3e564b6009dc09c6c5e36c018cd8d5d0 (patch) | |
| tree | 34b6c4e2cab19f9ce9cab940cc55cfbdf55aea0c /lib | |
| parent | eaabe97373baa68b5e3c396bf8e1f5a3f17ac1b6 (diff) | |
| download | nextcloud-server-e4addbae3e564b6009dc09c6c5e36c018cd8d5d0.tar.gz nextcloud-server-e4addbae3e564b6009dc09c6c5e36c018cd8d5d0.zip | |
Better check reshare permissions when creating a share
Signed-off-by: Joas Schilling <coding@schilljs.com>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/private/Share20/Manager.php | 25 |
1 files changed, 22 insertions, 3 deletions
diff --git a/lib/private/Share20/Manager.php b/lib/private/Share20/Manager.php index df9a06e3a96..4c31a29dc02 100644 --- a/lib/private/Share20/Manager.php +++ b/lib/private/Share20/Manager.php @@ -269,11 +269,13 @@ class Manager implements IManager { // And you can't share your rootfolder if ($this->userManager->userExists($share->getSharedBy())) { - $sharedPath = $this->rootFolder->getUserFolder($share->getSharedBy())->getPath(); + $userFolder = $this->rootFolder->getUserFolder($share->getSharedBy()); + $userFolderPath = $userFolder->getPath(); } else { - $sharedPath = $this->rootFolder->getUserFolder($share->getShareOwner())->getPath(); + $userFolder = $this->rootFolder->getUserFolder($share->getShareOwner()); + $userFolderPath = $userFolder->getPath(); } - if ($sharedPath === $share->getNode()->getPath()) { + if ($userFolderPath === $share->getNode()->getPath()) { throw new \InvalidArgumentException('You can’t share your root folder'); } @@ -297,6 +299,23 @@ class Manager implements IManager { $mount = $share->getNode()->getMountPoint(); if (!($mount instanceof MoveableMount)) { $permissions |= \OCP\Constants::PERMISSION_DELETE | \OCP\Constants::PERMISSION_UPDATE; + } else if ($share->getNode()->getOwner()->getUID() !== $share->getSharedBy()) { + $userMountPointId = $mount->getStorageRootId(); + $userMountPoints = $userFolder->getById($userMountPointId); + $userMountPoint = array_shift($userMountPoints); + + /* Check if this is an incoming share */ + $incomingShares = $this->getSharedWith($share->getSharedBy(), Share::SHARE_TYPE_USER, $userMountPoint, -1, 0); + $incomingShares = array_merge($incomingShares, $this->getSharedWith($share->getSharedBy(), Share::SHARE_TYPE_GROUP, $userMountPoint, -1, 0)); + $incomingShares = array_merge($incomingShares, $this->getSharedWith($share->getSharedBy(), Share::SHARE_TYPE_ROOM, $userMountPoint, -1, 0)); + + /** @var \OCP\Share\IShare[] $incomingShares */ + if (!empty($incomingShares)) { + $permissions = 0; + foreach ($incomingShares as $incomingShare) { + $permissions |= $incomingShare->getPermissions(); + } + } } // Check that we do not share with more permissions than we have |