4 files changed, 26 insertions, 8 deletions

diff --git a/apps/dav/lib/DAV/CustomPropertiesBackend.php b/apps/dav/lib/DAV/CustomPropertiesBackend.php
index c41ecd8450e..f3fff11b3da 100644
--- a/apps/dav/lib/DAV/CustomPropertiesBackend.php
+++ b/apps/dav/lib/DAV/CustomPropertiesBackend.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * SPDX-FileCopyrightText: 2017 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
@@ -92,6 +93,11 @@ class CustomPropertiesBackend implements BackendInterface {
 		'{http://nextcloud.org/ns}lock-time',
 		'{http://nextcloud.org/ns}lock-timeout',
 		'{http://nextcloud.org/ns}lock-token',
+		// photos
+		'{http://nextcloud.org/ns}realpath',
+		'{http://nextcloud.org/ns}nbItems',
+		'{http://nextcloud.org/ns}face-detections',
+		'{http://nextcloud.org/ns}face-preview-image',
 	];
 
 	/**
@@ -277,8 +283,8 @@ class CustomPropertiesBackend implements BackendInterface {
 	 */
 	public function move($source, $destination) {
 		$statement = $this->connection->prepare(
-			'UPDATE `*PREFIX*properties` SET `propertypath` = ?' .
-			' WHERE `userid` = ? AND `propertypath` = ?'
+			'UPDATE `*PREFIX*properties` SET `propertypath` = ?'
+			. ' WHERE `userid` = ? AND `propertypath` = ?'
 		);
 		$statement->execute([$this->formatPath($destination), $this->user->getUID(), $this->formatPath($source)]);
 		$statement->closeCursor();
diff --git a/apps/dav/lib/DAV/GroupPrincipalBackend.php b/apps/dav/lib/DAV/GroupPrincipalBackend.php
index ddbd64bdda1..77ba45182c9 100644
--- a/apps/dav/lib/DAV/GroupPrincipalBackend.php
+++ b/apps/dav/lib/DAV/GroupPrincipalBackend.php
@@ -1,4 +1,5 @@
 <?php
+
 /**
  * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
  * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
@@ -188,6 +189,10 @@ class GroupPrincipalBackend implements BackendInterface {
 					$groups = $this->groupManager->search($value, $searchLimit);
 
 					$results[] = array_reduce($groups, function (array $carry, IGroup $group) use ($restrictGroups) {
+						if ($group->hideFromCollaboration()) {
+							return $carry;
+						}
+
 						$gid = $group->getGID();
 						// is sharing restricted to groups only?
 						if ($restrictGroups !== false) {
diff --git a/apps/dav/lib/DAV/Sharing/Backend.php b/apps/dav/lib/DAV/Sharing/Backend.php
index de0d6891b7c..d60f5cca7c6 100644
--- a/apps/dav/lib/DAV/Sharing/Backend.php
+++ b/apps/dav/lib/DAV/Sharing/Backend.php
@@ -64,8 +64,8 @@ abstract class Backend {
 			}
 
 			$principalparts[2] = urldecode($principalparts[2]);
-			if (($principalparts[1] === 'users' && !$this->userManager->userExists($principalparts[2])) ||
-				($principalparts[1] === 'groups' && !$this->groupManager->groupExists($principalparts[2]))) {
+			if (($principalparts[1] === 'users' && !$this->userManager->userExists($principalparts[2]))
+				|| ($principalparts[1] === 'groups' && !$this->groupManager->groupExists($principalparts[2]))) {
 				// User or group does not exist
 				continue;
 			}
@@ -199,7 +199,7 @@ abstract class Backend {
 
 	public function unshare(IShareable $shareable, string $principalUri): bool {
 		$this->shareCache->clear();
-		
+
 		$principal = $this->principalBackend->findByUri($principalUri, '');
 		if (empty($principal)) {
 			return false;
diff --git a/apps/dav/lib/DAV/ViewOnlyPlugin.php b/apps/dav/lib/DAV/ViewOnlyPlugin.php
index 4c3b49a45b0..9b9615b8063 100644
--- a/apps/dav/lib/DAV/ViewOnlyPlugin.php
+++ b/apps/dav/lib/DAV/ViewOnlyPlugin.php
@@ -84,18 +84,25 @@ class ViewOnlyPlugin extends ServerPlugin {
 			if (!$storage->instanceOfStorage(ISharedStorage::class)) {
 				return true;
 			}
+
 			// Extract extra permissions
 			/** @var ISharedStorage $storage */
 			$share = $storage->getShare();
-
 			$attributes = $share->getAttributes();
 			if ($attributes === null) {
 				return true;
 			}
 
-			// Check if read-only and on whether permission can download is both set and disabled.
+			// We have two options here, if download is disabled, but viewing is allowed,
+			// we still allow the GET request to return the file content.
 			$canDownload = $attributes->getAttribute('permissions', 'download');
-			if ($canDownload !== null && !$canDownload) {
+			if (!$share->canSeeContent()) {
+				throw new Forbidden('Access to this shared resource has been denied because its download permission is disabled.');
+			}
+
+			// If download is disabled, we disable the COPY and MOVE methods even if the
+			// shareapi_allow_view_without_download is set to true.
+			if ($request->getMethod() !== 'GET' && ($canDownload !== null && !$canDownload)) {
 				throw new Forbidden('Access to this shared resource has been denied because its download permission is disabled.');
 			}
 		} catch (NotFound $e) {