diff options
Diffstat (limited to 'core/Controller/PreviewController.php')
| -rw-r--r-- | core/Controller/PreviewController.php | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/core/Controller/PreviewController.php b/core/Controller/PreviewController.php index a3b826c19e6..807df4a2ebc 100644 --- a/core/Controller/PreviewController.php +++ b/core/Controller/PreviewController.php @@ -8,7 +8,6 @@ declare(strict_types=1); */ namespace OC\Core\Controller; -use OCA\Files_Sharing\SharedStorage; use OCP\AppFramework\Controller; use OCP\AppFramework\Http; use OCP\AppFramework\Http\Attribute\FrontpageRoute; @@ -21,6 +20,7 @@ use OCP\Files\File; use OCP\Files\IRootFolder; use OCP\Files\Node; use OCP\Files\NotFoundException; +use OCP\Files\Storage\ISharedStorage; use OCP\IPreview; use OCP\IRequest; use OCP\Preview\IMimeIconProvider; @@ -145,12 +145,17 @@ class PreviewController extends Controller { return new DataResponse([], Http::STATUS_NOT_FOUND); } + // Is this header is set it means our UI is doing a preview for no-download shares + // we check a header so we at least prevent people from using the link directly (obfuscation) + $isNextcloudPreview = $this->request->getHeader('X-NC-Preview') === 'true'; $storage = $node->getStorage(); - if ($storage->instanceOfStorage(SharedStorage::class)) { - /** @var SharedStorage $storage */ + if ($isNextcloudPreview === false && $storage->instanceOfStorage(ISharedStorage::class)) { + /** @var ISharedStorage $storage */ $share = $storage->getShare(); $attributes = $share->getAttributes(); - if ($attributes !== null && $attributes->getAttribute('permissions', 'download') === false) { + // No "allow preview" header set, so we must check if + // the share has not explicitly disabled download permissions + if ($attributes?->getAttribute('permissions', 'download') === false) { return new DataResponse([], Http::STATUS_FORBIDDEN); } } |