11 files changed, 148 insertions, 335 deletions

diff --git a/apps/workflowengine/lib/Check/AbstractStringCheck.php b/apps/workflowengine/lib/Check/AbstractStringCheck.php
index f42da048f21..d92e9901365 100644
--- a/apps/workflowengine/lib/Check/AbstractStringCheck.php
+++ b/apps/workflowengine/lib/Check/AbstractStringCheck.php
@@ -1,24 +1,9 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCP\IL10N;
@@ -30,14 +15,12 @@ abstract class AbstractStringCheck implements ICheck {
 	/** @var array[] Nested array: [Pattern => [ActualValue => Regex Result]] */
 	protected $matches;
 
-	/** @var IL10N */
-	protected $l;
-
 	/**
 	 * @param IL10N $l
 	 */
-	public function __construct(IL10N $l) {
-		$this->l = $l;
+	public function __construct(
+		protected IL10N $l,
+	) {
 	}
 
 	/**
@@ -86,8 +69,8 @@ abstract class AbstractStringCheck implements ICheck {
 			throw new \UnexpectedValueException($this->l->t('The given operator is invalid'), 1);
 		}
 
-		if (in_array($operator, ['matches', '!matches']) &&
-			  @preg_match($value, null) === false) {
+		if (in_array($operator, ['matches', '!matches'])
+			  && @preg_match($value, null) === false) {
 			throw new \UnexpectedValueException($this->l->t('The given regular expression is invalid'), 2);
 		}
 	}
diff --git a/apps/workflowengine/lib/Check/FileMimeType.php b/apps/workflowengine/lib/Check/FileMimeType.php
index 8d9e2468ebd..a8dfa64528e 100644
--- a/apps/workflowengine/lib/Check/FileMimeType.php
+++ b/apps/workflowengine/lib/Check/FileMimeType.php
@@ -1,26 +1,12 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
+use OC\Files\Storage\Local;
 use OCA\WorkflowEngine\Entity\File;
 use OCP\Files\IMimeTypeDetector;
 use OCP\Files\Storage\IStorage;
@@ -36,21 +22,17 @@ class FileMimeType extends AbstractStringCheck implements IFileCheck {
 	/** @var array */
 	protected $mimeType;
 
-	/** @var IRequest */
-	protected $request;
-
-	/** @var IMimeTypeDetector */
-	protected $mimeTypeDetector;
-
 	/**
 	 * @param IL10N $l
 	 * @param IRequest $request
 	 * @param IMimeTypeDetector $mimeTypeDetector
 	 */
-	public function __construct(IL10N $l, IRequest $request, IMimeTypeDetector $mimeTypeDetector) {
+	public function __construct(
+		IL10N $l,
+		protected IRequest $request,
+		protected IMimeTypeDetector $mimeTypeDetector,
+	) {
 		parent::__construct($l);
-		$this->request = $request;
-		$this->mimeTypeDetector = $mimeTypeDetector;
 	}
 
 	/**
@@ -71,7 +53,7 @@ class FileMimeType extends AbstractStringCheck implements IFileCheck {
 	}
 
 	/**
-	 * The mimetype is only cached if the file exists. Otherwise files access
+	 * The mimetype is only cached if the file has a valid mimetype. Otherwise files access
 	 * control will cache "application/octet-stream" for all the target node on:
 	 * rename, move, copy and all other methods which create a new item
 	 *
@@ -86,7 +68,7 @@ class FileMimeType extends AbstractStringCheck implements IFileCheck {
 	 * @return string
 	 */
 	protected function cacheAndReturnMimeType(string $storageId, ?string $path, string $mimeType): string {
-		if ($path !== null && $this->storage->file_exists($path)) {
+		if ($path !== null && $mimeType !== 'application/octet-stream') {
 			$this->mimeType[$storageId][$path] = $mimeType;
 		}
 
@@ -101,13 +83,7 @@ class FileMimeType extends AbstractStringCheck implements IFileCheck {
 	 * @return bool
 	 */
 	public function executeCheck($operator, $value) {
-		$actualValue = $this->getActualValue();
-		$plainMimetypeResult = $this->executeStringCheck($operator, $value, $actualValue);
-		if ($actualValue === 'httpd/unix-directory') {
-			return $plainMimetypeResult;
-		}
-		$detectMimetypeBasedOnFilenameResult = $this->executeStringCheck($operator, $value, $this->mimeTypeDetector->detectPath($this->path));
-		return $plainMimetypeResult || $detectMimetypeBasedOnFilenameResult;
+		return $this->executeStringCheck($operator, $value, $this->getActualValue());
 	}
 
 	/**
@@ -117,12 +93,15 @@ class FileMimeType extends AbstractStringCheck implements IFileCheck {
 		if ($this->mimeType[$this->storage->getId()][$this->path] !== null) {
 			return $this->mimeType[$this->storage->getId()][$this->path];
 		}
-
-		if ($this->storage->is_dir($this->path)) {
-			return $this->cacheAndReturnMimeType($this->storage->getId(), $this->path, 'httpd/unix-directory');
+		$cacheEntry = $this->storage->getCache()->get($this->path);
+		if ($cacheEntry && $cacheEntry->getMimeType() !== 'application/octet-stream') {
+			return $this->cacheAndReturnMimeType($this->storage->getId(), $this->path, $cacheEntry->getMimeType());
 		}
 
-		if ($this->storage->file_exists($this->path)) {
+		if ($this->storage->file_exists($this->path)
+			&& $this->storage->filesize($this->path)
+			&& $this->storage->instanceOfStorage(Local::class)
+		) {
 			$path = $this->storage->getLocalFile($this->path);
 			$mimeType = $this->mimeTypeDetector->detectContent($path);
 			return $this->cacheAndReturnMimeType($this->storage->getId(), $this->path, $mimeType);
@@ -147,12 +126,12 @@ class FileMimeType extends AbstractStringCheck implements IFileCheck {
 	 */
 	protected function isWebDAVRequest() {
 		return substr($this->request->getScriptName(), 0 - strlen('/remote.php')) === '/remote.php' && (
-			$this->request->getPathInfo() === '/webdav' ||
-			strpos($this->request->getPathInfo(), '/webdav/') === 0 ||
-			$this->request->getPathInfo() === '/dav/files' ||
-			strpos($this->request->getPathInfo(), '/dav/files/') === 0 ||
-			$this->request->getPathInfo() === '/dav/uploads' ||
-			strpos($this->request->getPathInfo(), '/dav/uploads/') === 0
+			$this->request->getPathInfo() === '/webdav'
+			|| str_starts_with($this->request->getPathInfo() ?? '', '/webdav/')
+			|| $this->request->getPathInfo() === '/dav/files'
+			|| str_starts_with($this->request->getPathInfo() ?? '', '/dav/files/')
+			|| $this->request->getPathInfo() === '/dav/uploads'
+			|| str_starts_with($this->request->getPathInfo() ?? '', '/dav/uploads/')
 		);
 	}
 
@@ -161,8 +140,8 @@ class FileMimeType extends AbstractStringCheck implements IFileCheck {
 	 */
 	protected function isPublicWebDAVRequest() {
 		return substr($this->request->getScriptName(), 0 - strlen('/public.php')) === '/public.php' && (
-			$this->request->getPathInfo() === '/webdav' ||
-			strpos($this->request->getPathInfo(), '/webdav/') === 0
+			$this->request->getPathInfo() === '/webdav'
+			|| str_starts_with($this->request->getPathInfo() ?? '', '/webdav/')
 		);
 	}
 
diff --git a/apps/workflowengine/lib/Check/FileName.php b/apps/workflowengine/lib/Check/FileName.php
index 9a564f85f63..4a9d503018f 100644
--- a/apps/workflowengine/lib/Check/FileName.php
+++ b/apps/workflowengine/lib/Check/FileName.php
@@ -1,26 +1,11 @@
 <?php
 
 declare(strict_types=1);
+
 /**
- * @copyright Copyright (c) 2018 Daniel Kesselberg <mail@danielkesselberg.de>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OC\Files\Storage\Local;
@@ -33,19 +18,16 @@ use OCP\WorkflowEngine\IFileCheck;
 class FileName extends AbstractStringCheck implements IFileCheck {
 	use TFileCheck;
 
-	/** @var IRequest */
-	protected $request;
-	/** @var IMountManager */
-	private $mountManager;
-
 	/**
 	 * @param IL10N $l
 	 * @param IRequest $request
 	 */
-	public function __construct(IL10N $l, IRequest $request, IMountManager $mountManager) {
+	public function __construct(
+		IL10N $l,
+		protected IRequest $request,
+		private IMountManager $mountManager,
+	) {
 		parent::__construct($l);
-		$this->request = $request;
-		$this->mountManager = $mountManager;
 	}
 
 	/**
@@ -54,7 +36,7 @@ class FileName extends AbstractStringCheck implements IFileCheck {
 	protected function getActualValue(): string {
 		$fileName = $this->path === null ? '' : basename($this->path);
 		if ($fileName === '' && (!$this->storage->isLocal() || $this->storage->instanceOfStorage(Local::class))) {
-			// Return the mountpoint name of external storages that are not mounted as user home
+			// Return the mountpoint name of external storage that are not mounted as user home
 			$mountPoints = $this->mountManager->findByStorageId($this->storage->getId());
 			if (empty($mountPoints) || $mountPoints[0]->getMountType() !== 'external') {
 				return $fileName;
diff --git a/apps/workflowengine/lib/Check/FileSize.php b/apps/workflowengine/lib/Check/FileSize.php
index 741426082dc..5ee03ccc9cf 100644
--- a/apps/workflowengine/lib/Check/FileSize.php
+++ b/apps/workflowengine/lib/Check/FileSize.php
@@ -1,24 +1,9 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCA\WorkflowEngine\Entity\File;
@@ -32,19 +17,14 @@ class FileSize implements ICheck {
 	/** @var int */
 	protected $size;
 
-	/** @var IL10N */
-	protected $l;
-
-	/** @var IRequest */
-	protected $request;
-
 	/**
 	 * @param IL10N $l
 	 * @param IRequest $request
 	 */
-	public function __construct(IL10N $l, IRequest $request) {
-		$this->l = $l;
-		$this->request = $request;
+	public function __construct(
+		protected IL10N $l,
+		protected IRequest $request,
+	) {
 	}
 
 	/**
diff --git a/apps/workflowengine/lib/Check/FileSystemTags.php b/apps/workflowengine/lib/Check/FileSystemTags.php
index 530509608a1..811571f558a 100644
--- a/apps/workflowengine/lib/Check/FileSystemTags.php
+++ b/apps/workflowengine/lib/Check/FileSystemTags.php
@@ -1,31 +1,20 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
+use OC\Files\Storage\Wrapper\Jail;
 use OCA\Files_Sharing\SharedStorage;
 use OCA\WorkflowEngine\Entity\File;
 use OCP\Files\Cache\ICache;
 use OCP\Files\IHomeStorage;
+use OCP\IGroupManager;
 use OCP\IL10N;
+use OCP\IUser;
+use OCP\IUserSession;
 use OCP\SystemTag\ISystemTagManager;
 use OCP\SystemTag\ISystemTagObjectMapper;
 use OCP\SystemTag\TagNotFoundException;
@@ -41,24 +30,13 @@ class FileSystemTags implements ICheck, IFileCheck {
 	/** @var array */
 	protected $fileSystemTags;
 
-	/** @var IL10N */
-	protected $l;
-
-	/** @var ISystemTagManager */
-	protected $systemTagManager;
-
-	/** @var ISystemTagObjectMapper */
-	protected $systemTagObjectMapper;
-
-	/**
-	 * @param IL10N $l
-	 * @param ISystemTagManager $systemTagManager
-	 * @param ISystemTagObjectMapper $systemTagObjectMapper
-	 */
-	public function __construct(IL10N $l, ISystemTagManager $systemTagManager, ISystemTagObjectMapper $systemTagObjectMapper) {
-		$this->l = $l;
-		$this->systemTagManager = $systemTagManager;
-		$this->systemTagObjectMapper = $systemTagObjectMapper;
+	public function __construct(
+		protected IL10N $l,
+		protected ISystemTagManager $systemTagManager,
+		protected ISystemTagObjectMapper $systemTagObjectMapper,
+		protected IUserSession $userSession,
+		protected IGroupManager $groupManager,
+	) {
 	}
 
 	/**
@@ -82,7 +60,18 @@ class FileSystemTags implements ICheck, IFileCheck {
 		}
 
 		try {
-			$this->systemTagManager->getTagsByIds($value);
+			$tags = $this->systemTagManager->getTagsByIds($value);
+
+			$user = $this->userSession->getUser();
+			$isAdmin = $user instanceof IUser && $this->groupManager->isAdmin($user->getUID());
+
+			if (!$isAdmin) {
+				foreach ($tags as $tag) {
+					if (!$tag->isUserVisible()) {
+						throw new \UnexpectedValueException($this->l->t('The given tag id is invalid'), 4);
+					}
+				}
+			}
 		} catch (TagNotFoundException $e) {
 			throw new \UnexpectedValueException($this->l->t('The given tag id is invalid'), 2);
 		} catch (\InvalidArgumentException $e) {
@@ -128,8 +117,14 @@ class FileSystemTags implements ICheck, IFileCheck {
 	 */
 	protected function getFileIds(ICache $cache, $path, $isExternalStorage) {
 		$cacheId = $cache->getNumericStorageId();
-		if (isset($this->fileIds[$cacheId][$path])) {
-			return $this->fileIds[$cacheId][$path];
+		if ($this->storage->instanceOfStorage(Jail::class)) {
+			$absolutePath = $this->storage->getUnjailedPath($path);
+		} else {
+			$absolutePath = $path;
+		}
+
+		if (isset($this->fileIds[$cacheId][$absolutePath])) {
+			return $this->fileIds[$cacheId][$absolutePath];
 		}
 
 		$parentIds = [];
@@ -141,10 +136,10 @@ class FileSystemTags implements ICheck, IFileCheck {
 
 		$fileId = $cache->getId($path);
 		if ($fileId !== -1) {
-			$parentIds[] = $cache->getId($path);
+			$parentIds[] = $fileId;
 		}
 
-		$this->fileIds[$cacheId][$path] = $parentIds;
+		$this->fileIds[$cacheId][$absolutePath] = $parentIds;
 
 		return $parentIds;
 	}
diff --git a/apps/workflowengine/lib/Check/RequestRemoteAddress.php b/apps/workflowengine/lib/Check/RequestRemoteAddress.php
index abc13bf9e38..b6f8fef5aed 100644
--- a/apps/workflowengine/lib/Check/RequestRemoteAddress.php
+++ b/apps/workflowengine/lib/Check/RequestRemoteAddress.php
@@ -1,24 +1,9 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCP\IL10N;
@@ -27,19 +12,14 @@ use OCP\WorkflowEngine\ICheck;
 
 class RequestRemoteAddress implements ICheck {
 
-	/** @var IL10N */
-	protected $l;
-
-	/** @var IRequest */
-	protected $request;
-
 	/**
 	 * @param IL10N $l
 	 * @param IRequest $request
 	 */
-	public function __construct(IL10N $l, IRequest $request) {
-		$this->l = $l;
-		$this->request = $request;
+	public function __construct(
+		protected IL10N $l,
+		protected IRequest $request,
+	) {
 	}
 
 	/**
diff --git a/apps/workflowengine/lib/Check/RequestTime.php b/apps/workflowengine/lib/Check/RequestTime.php
index df210cdae58..a49986652b8 100644
--- a/apps/workflowengine/lib/Check/RequestTime.php
+++ b/apps/workflowengine/lib/Check/RequestTime.php
@@ -1,24 +1,9 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCP\AppFramework\Utility\ITimeFactory;
@@ -32,18 +17,13 @@ class RequestTime implements ICheck {
 	/** @var bool[] */
 	protected $cachedResults;
 
-	/** @var IL10N */
-	protected $l;
-
-	/** @var ITimeFactory */
-	protected $timeFactory;
-
 	/**
 	 * @param ITimeFactory $timeFactory
 	 */
-	public function __construct(IL10N $l, ITimeFactory $timeFactory) {
-		$this->l = $l;
-		$this->timeFactory = $timeFactory;
+	public function __construct(
+		protected IL10N $l,
+		protected ITimeFactory $timeFactory,
+	) {
 	}
 
 	/**
@@ -79,11 +59,11 @@ class RequestTime implements ICheck {
 	 * @return int
 	 */
 	protected function getTimestamp($currentTimestamp, $value) {
-		list($time1, $timezone1) = explode(' ', $value);
-		list($hour1, $minute1) = explode(':', $time1);
+		[$time1, $timezone1] = explode(' ', $value);
+		[$hour1, $minute1] = explode(':', $time1);
 		$date1 = new \DateTime('now', new \DateTimeZone($timezone1));
 		$date1->setTimestamp($currentTimestamp);
-		$date1->setTime($hour1, $minute1);
+		$date1->setTime((int)$hour1, (int)$minute1);
 
 		return $date1->getTimestamp();
 	}
@@ -105,12 +85,12 @@ class RequestTime implements ICheck {
 		}
 
 		$values = json_decode($value, true);
-		$time1 = \DateTime::createFromFormat('H:i e', $values[0]);
+		$time1 = \DateTime::createFromFormat('H:i e', (string)$values[0]);
 		if ($time1 === false) {
 			throw new \UnexpectedValueException($this->l->t('The given start time is invalid'), 3);
 		}
 
-		$time2 = \DateTime::createFromFormat('H:i e', $values[1]);
+		$time2 = \DateTime::createFromFormat('H:i e', (string)$values[1]);
 		if ($time2 === false) {
 			throw new \UnexpectedValueException($this->l->t('The given end time is invalid'), 4);
 		}
diff --git a/apps/workflowengine/lib/Check/RequestURL.php b/apps/workflowengine/lib/Check/RequestURL.php
index 30424a1ee47..fb2ac7e8fd5 100644
--- a/apps/workflowengine/lib/Check/RequestURL.php
+++ b/apps/workflowengine/lib/Check/RequestURL.php
@@ -1,44 +1,29 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCP\IL10N;
 use OCP\IRequest;
 
 class RequestURL extends AbstractStringCheck {
+	public const CLI = 'cli';
 
-	/** @var string */
+	/** @var ?string */
 	protected $url;
 
-	/** @var IRequest */
-	protected $request;
-
 	/**
 	 * @param IL10N $l
 	 * @param IRequest $request
 	 */
-	public function __construct(IL10N $l, IRequest $request) {
+	public function __construct(
+		IL10N $l,
+		protected IRequest $request,
+	) {
 		parent::__construct($l);
-		$this->request = $request;
 	}
 
 	/**
@@ -47,7 +32,11 @@ class RequestURL extends AbstractStringCheck {
 	 * @return bool
 	 */
 	public function executeCheck($operator, $value) {
-		$actualValue = $this->getActualValue();
+		if (\OC::$CLI) {
+			$actualValue = $this->url = RequestURL::CLI;
+		} else {
+			$actualValue = $this->getActualValue();
+		}
 		if (in_array($operator, ['is', '!is'])) {
 			switch ($value) {
 				case 'webdav':
@@ -77,15 +66,15 @@ class RequestURL extends AbstractStringCheck {
 		return $this->url; // E.g. https://localhost/nextcloud/index.php/apps/files_texteditor/ajax/loadfile
 	}
 
-	/**
-	 * @return bool
-	 */
-	protected function isWebDAVRequest() {
+	protected function isWebDAVRequest(): bool {
+		if ($this->url === RequestURL::CLI) {
+			return false;
+		}
 		return substr($this->request->getScriptName(), 0 - strlen('/remote.php')) === '/remote.php' && (
-			$this->request->getPathInfo() === '/webdav' ||
-			strpos($this->request->getPathInfo(), '/webdav/') === 0 ||
-			$this->request->getPathInfo() === '/dav/files' ||
-			strpos($this->request->getPathInfo(), '/dav/files/') === 0
+			$this->request->getPathInfo() === '/webdav'
+			|| str_starts_with($this->request->getPathInfo() ?? '', '/webdav/')
+			|| $this->request->getPathInfo() === '/dav/files'
+			|| str_starts_with($this->request->getPathInfo() ?? '', '/dav/files/')
 		);
 	}
 }
diff --git a/apps/workflowengine/lib/Check/RequestUserAgent.php b/apps/workflowengine/lib/Check/RequestUserAgent.php
index d5ca80e9d3e..572ef567074 100644
--- a/apps/workflowengine/lib/Check/RequestUserAgent.php
+++ b/apps/workflowengine/lib/Check/RequestUserAgent.php
@@ -1,24 +1,9 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Joas Schilling <coding@schilljs.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCP\IL10N;
@@ -26,16 +11,15 @@ use OCP\IRequest;
 
 class RequestUserAgent extends AbstractStringCheck {
 
-	/** @var IRequest */
-	protected $request;
-
 	/**
 	 * @param IL10N $l
 	 * @param IRequest $request
 	 */
-	public function __construct(IL10N $l, IRequest $request) {
+	public function __construct(
+		IL10N $l,
+		protected IRequest $request,
+	) {
 		parent::__construct($l);
-		$this->request = $request;
 	}
 
 	/**
diff --git a/apps/workflowengine/lib/Check/TFileCheck.php b/apps/workflowengine/lib/Check/TFileCheck.php
index 90eb7dc616c..a514352e047 100644
--- a/apps/workflowengine/lib/Check/TFileCheck.php
+++ b/apps/workflowengine/lib/Check/TFileCheck.php
@@ -1,33 +1,17 @@
 <?php
 
 declare(strict_types=1);
+
 /**
- * @copyright Copyright (c) 2019 Arthur Schiwon <blizzz@arthur-schiwon.de>
- *
- * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCA\WorkflowEngine\AppInfo\Application;
 use OCA\WorkflowEngine\Entity\File;
 use OCP\Files\Node;
+use OCP\Files\NotFoundException;
 use OCP\Files\Storage\IStorage;
 use OCP\WorkflowEngine\IEntity;
 
@@ -54,7 +38,7 @@ trait TFileCheck {
 	}
 
 	/**
-	 * @throws \OCP\Files\NotFoundException
+	 * @throws NotFoundException
 	 */
 	public function setEntitySubject(IEntity $entity, $subject): void {
 		if ($entity instanceof File) {
diff --git a/apps/workflowengine/lib/Check/UserGroupMembership.php b/apps/workflowengine/lib/Check/UserGroupMembership.php
index 27b2ce1879c..690f9974a49 100644
--- a/apps/workflowengine/lib/Check/UserGroupMembership.php
+++ b/apps/workflowengine/lib/Check/UserGroupMembership.php
@@ -1,24 +1,9 @@
 <?php
+
 /**
- * @copyright Copyright (c) 2016 Morris Jobke <hey@morrisjobke.de>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-
 namespace OCA\WorkflowEngine\Check;
 
 use OCP\IGroupManager;
@@ -36,24 +21,16 @@ class UserGroupMembership implements ICheck {
 	/** @var string[] */
 	protected $cachedGroupMemberships;
 
-	/** @var IUserSession */
-	protected $userSession;
-
-	/** @var IGroupManager */
-	protected $groupManager;
-
-	/** @var IL10N */
-	protected $l;
-
 	/**
 	 * @param IUserSession $userSession
 	 * @param IGroupManager $groupManager
 	 * @param IL10N $l
 	 */
-	public function __construct(IUserSession $userSession, IGroupManager $groupManager, IL10N $l) {
-		$this->userSession = $userSession;
-		$this->groupManager = $groupManager;
-		$this->l = $l;
+	public function __construct(
+		protected IUserSession $userSession,
+		protected IGroupManager $groupManager,
+		protected IL10N $l,
+	) {
 	}
 
 	/**