diff options
Diffstat (limited to 'lib/private/Share20/Manager.php')
| -rw-r--r-- | lib/private/Share20/Manager.php | 1466 |
1 files changed, 813 insertions, 653 deletions
diff --git a/lib/private/Share20/Manager.php b/lib/private/Share20/Manager.php index 32bc0363b99..28f29d6b20f 100644 --- a/lib/private/Share20/Manager.php +++ b/lib/private/Share20/Manager.php @@ -1,175 +1,95 @@ <?php + /** - * @copyright Copyright (c) 2016, ownCloud, Inc. - * - * @author Arthur Schiwon <blizzz@arthur-schiwon.de> - * @author Bjoern Schiessle <bjoern@schiessle.org> - * @author Björn Schießle <bjoern@schiessle.org> - * @author Christoph Wurst <christoph@winzerhof-wurst.at> - * @author Daniel Calviño Sánchez <danxuliu@gmail.com> - * @author Daniel Kesselberg <mail@danielkesselberg.de> - * @author Jan-Christoph Borchardt <hey@jancborchardt.net> - * @author Joas Schilling <coding@schilljs.com> - * @author John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com> - * @author Julius Härtl <jus@bitgrid.net> - * @author Lukas Reschke <lukas@statuscode.ch> - * @author Maxence Lange <maxence@artificial-owl.com> - * @author Maxence Lange <maxence@nextcloud.com> - * @author Morris Jobke <hey@morrisjobke.de> - * @author Pauli Järvinen <pauli.jarvinen@gmail.com> - * @author Robin Appelman <robin@icewind.nl> - * @author Roeland Jago Douma <roeland@famdouma.nl> - * @author Vincent Petry <vincent@nextcloud.com> - * - * @license AGPL-3.0 - * - * This code is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License, version 3, - * as published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License, version 3, - * along with this program. If not, see <http://www.gnu.org/licenses/> - * + * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors + * SPDX-FileCopyrightText: 2016 ownCloud, Inc. + * SPDX-License-Identifier: AGPL-3.0-only */ - namespace OC\Share20; -use OC\Cache\CappedMemoryCache; +use OC\Core\AppInfo\ConfigLexicon; use OC\Files\Mount\MoveableMount; -use OC\HintException; +use OC\KnownUser\KnownUserService; use OC\Share20\Exception\ProviderException; -use OCA\Files_Sharing\ISharedStorage; +use OCA\Files_Sharing\AppInfo\Application; +use OCA\Files_Sharing\SharedStorage; +use OCA\ShareByMail\ShareByMailProvider; use OCP\EventDispatcher\IEventDispatcher; use OCP\Files\File; use OCP\Files\Folder; use OCP\Files\IRootFolder; use OCP\Files\Mount\IMountManager; +use OCP\Files\Mount\IShareOwnerlessMount; use OCP\Files\Node; +use OCP\Files\NotFoundException; +use OCP\HintException; +use OCP\IAppConfig; use OCP\IConfig; +use OCP\IDateTimeZone; use OCP\IGroupManager; use OCP\IL10N; -use OCP\ILogger; use OCP\IURLGenerator; use OCP\IUser; use OCP\IUserManager; +use OCP\IUserSession; use OCP\L10N\IFactory; use OCP\Mail\IMailer; use OCP\Security\Events\ValidatePasswordPolicyEvent; use OCP\Security\IHasher; use OCP\Security\ISecureRandom; +use OCP\Security\PasswordContext; use OCP\Share; +use OCP\Share\Events\BeforeShareDeletedEvent; +use OCP\Share\Events\ShareAcceptedEvent; +use OCP\Share\Events\ShareCreatedEvent; +use OCP\Share\Events\ShareDeletedEvent; +use OCP\Share\Events\ShareDeletedFromSelfEvent; +use OCP\Share\Exceptions\AlreadySharedException; use OCP\Share\Exceptions\GenericShareException; use OCP\Share\Exceptions\ShareNotFound; +use OCP\Share\Exceptions\ShareTokenException; use OCP\Share\IManager; use OCP\Share\IProviderFactory; use OCP\Share\IShare; use OCP\Share\IShareProvider; -use Symfony\Component\EventDispatcher\EventDispatcherInterface; -use Symfony\Component\EventDispatcher\GenericEvent; +use OCP\Share\IShareProviderSupportsAccept; +use OCP\Share\IShareProviderSupportsAllSharesInFolder; +use OCP\Share\IShareProviderWithNotification; +use Psr\Log\LoggerInterface; /** * This class is the communication hub for all sharing related operations. */ class Manager implements IManager { - /** @var IProviderFactory */ - private $factory; - /** @var ILogger */ - private $logger; - /** @var IConfig */ - private $config; - /** @var ISecureRandom */ - private $secureRandom; - /** @var IHasher */ - private $hasher; - /** @var IMountManager */ - private $mountManager; - /** @var IGroupManager */ - private $groupManager; - /** @var IL10N */ - private $l; - /** @var IFactory */ - private $l10nFactory; - /** @var IUserManager */ - private $userManager; - /** @var IRootFolder */ - private $rootFolder; - /** @var CappedMemoryCache */ - private $sharingDisabledForUsersCache; - /** @var EventDispatcherInterface */ - private $legacyDispatcher; - /** @var LegacyHooks */ - private $legacyHooks; - /** @var IMailer */ - private $mailer; - /** @var IURLGenerator */ - private $urlGenerator; - /** @var \OC_Defaults */ - private $defaults; - /** @var IEventDispatcher */ - private $dispatcher; - + private ?IL10N $l; + private LegacyHooks $legacyHooks; - /** - * Manager constructor. - * - * @param ILogger $logger - * @param IConfig $config - * @param ISecureRandom $secureRandom - * @param IHasher $hasher - * @param IMountManager $mountManager - * @param IGroupManager $groupManager - * @param IL10N $l - * @param IFactory $l10nFactory - * @param IProviderFactory $factory - * @param IUserManager $userManager - * @param IRootFolder $rootFolder - * @param EventDispatcherInterface $eventDispatcher - * @param IMailer $mailer - * @param IURLGenerator $urlGenerator - * @param \OC_Defaults $defaults - */ public function __construct( - ILogger $logger, - IConfig $config, - ISecureRandom $secureRandom, - IHasher $hasher, - IMountManager $mountManager, - IGroupManager $groupManager, - IL10N $l, - IFactory $l10nFactory, - IProviderFactory $factory, - IUserManager $userManager, - IRootFolder $rootFolder, - EventDispatcherInterface $legacyDispatcher, - IMailer $mailer, - IURLGenerator $urlGenerator, - \OC_Defaults $defaults, - IEventDispatcher $dispatcher + private LoggerInterface $logger, + private IConfig $config, + private ISecureRandom $secureRandom, + private IHasher $hasher, + private IMountManager $mountManager, + private IGroupManager $groupManager, + private IFactory $l10nFactory, + private IProviderFactory $factory, + private IUserManager $userManager, + private IRootFolder $rootFolder, + private IMailer $mailer, + private IURLGenerator $urlGenerator, + private \OC_Defaults $defaults, + private IEventDispatcher $dispatcher, + private IUserSession $userSession, + private KnownUserService $knownUserService, + private ShareDisableChecker $shareDisableChecker, + private IDateTimeZone $dateTimeZone, + private IAppConfig $appConfig, ) { - $this->logger = $logger; - $this->config = $config; - $this->secureRandom = $secureRandom; - $this->hasher = $hasher; - $this->mountManager = $mountManager; - $this->groupManager = $groupManager; - $this->l = $l; - $this->l10nFactory = $l10nFactory; - $this->factory = $factory; - $this->userManager = $userManager; - $this->rootFolder = $rootFolder; - $this->legacyDispatcher = $legacyDispatcher; - $this->sharingDisabledForUsersCache = new CappedMemoryCache(); - $this->legacyHooks = new LegacyHooks($this->legacyDispatcher); - $this->mailer = $mailer; - $this->urlGenerator = $urlGenerator; - $this->defaults = $defaults; - $this->dispatcher = $dispatcher; + $this->l = $this->l10nFactory->get('lib'); + // The constructor of LegacyHooks registers the listeners of share events + // do not remove if those are not properly migrated + $this->legacyHooks = new LegacyHooks($this->dispatcher); } /** @@ -186,13 +106,13 @@ class Manager implements IManager { * Verify if a password meets all requirements * * @param string $password - * @throws \Exception + * @throws HintException */ protected function verifyPassword($password) { if ($password === null) { // No password is set, check if this is allowed. if ($this->shareApiLinkEnforcePassword()) { - throw new \InvalidArgumentException('Passwords are enforced for link shares'); + throw new \InvalidArgumentException($this->l->t('Passwords are enforced for link and mail shares')); } return; @@ -200,9 +120,11 @@ class Manager implements IManager { // Let others verify the password try { - $this->legacyDispatcher->dispatch(new ValidatePasswordPolicyEvent($password)); + $event = new ValidatePasswordPolicyEvent($password, PasswordContext::SHARING); + $this->dispatcher->dispatchTyped($event); } catch (HintException $e) { - throw new \Exception($e->getHint()); + /* Wrap in a 400 bad request error */ + throw new HintException($e->getMessage(), $e->getHint(), 400, $e); } } @@ -215,160 +137,133 @@ class Manager implements IManager { * * @suppress PhanUndeclaredClassMethod */ - protected function generalCreateChecks(IShare $share) { + protected function generalCreateChecks(IShare $share, bool $isUpdate = false) { if ($share->getShareType() === IShare::TYPE_USER) { // We expect a valid user as sharedWith for user shares if (!$this->userManager->userExists($share->getSharedWith())) { - throw new \InvalidArgumentException('SharedWith is not a valid user'); + throw new \InvalidArgumentException($this->l->t('Share recipient is not a valid user')); } } elseif ($share->getShareType() === IShare::TYPE_GROUP) { // We expect a valid group as sharedWith for group shares if (!$this->groupManager->groupExists($share->getSharedWith())) { - throw new \InvalidArgumentException('SharedWith is not a valid group'); + throw new \InvalidArgumentException($this->l->t('Share recipient is not a valid group')); } } elseif ($share->getShareType() === IShare::TYPE_LINK) { + // No check for TYPE_EMAIL here as we have a recipient for them if ($share->getSharedWith() !== null) { - throw new \InvalidArgumentException('SharedWith should be empty'); + throw new \InvalidArgumentException($this->l->t('Share recipient should be empty')); } - } elseif ($share->getShareType() === IShare::TYPE_REMOTE) { + } elseif ($share->getShareType() === IShare::TYPE_EMAIL) { if ($share->getSharedWith() === null) { - throw new \InvalidArgumentException('SharedWith should not be empty'); + throw new \InvalidArgumentException($this->l->t('Share recipient should not be empty')); } - } elseif ($share->getShareType() === IShare::TYPE_REMOTE_GROUP) { + } elseif ($share->getShareType() === IShare::TYPE_REMOTE) { if ($share->getSharedWith() === null) { - throw new \InvalidArgumentException('SharedWith should not be empty'); + throw new \InvalidArgumentException($this->l->t('Share recipient should not be empty')); } - } elseif ($share->getShareType() === IShare::TYPE_EMAIL) { + } elseif ($share->getShareType() === IShare::TYPE_REMOTE_GROUP) { if ($share->getSharedWith() === null) { - throw new \InvalidArgumentException('SharedWith should not be empty'); + throw new \InvalidArgumentException($this->l->t('Share recipient should not be empty')); } } elseif ($share->getShareType() === IShare::TYPE_CIRCLE) { $circle = \OCA\Circles\Api\v1\Circles::detailsCircle($share->getSharedWith()); if ($circle === null) { - throw new \InvalidArgumentException('SharedWith is not a valid circle'); + throw new \InvalidArgumentException($this->l->t('Share recipient is not a valid circle')); } } elseif ($share->getShareType() === IShare::TYPE_ROOM) { } elseif ($share->getShareType() === IShare::TYPE_DECK) { + } elseif ($share->getShareType() === IShare::TYPE_SCIENCEMESH) { } else { - // We can't handle other types yet - throw new \InvalidArgumentException('unknown share type'); + // We cannot handle other types yet + throw new \InvalidArgumentException($this->l->t('Unknown share type')); } // Verify the initiator of the share is set if ($share->getSharedBy() === null) { - throw new \InvalidArgumentException('SharedBy should be set'); + throw new \InvalidArgumentException($this->l->t('Share initiator must be set')); } // Cannot share with yourself - if ($share->getShareType() === IShare::TYPE_USER && - $share->getSharedWith() === $share->getSharedBy()) { - throw new \InvalidArgumentException('Can’t share with yourself'); + if ($share->getShareType() === IShare::TYPE_USER + && $share->getSharedWith() === $share->getSharedBy()) { + throw new \InvalidArgumentException($this->l->t('Cannot share with yourself')); } // The path should be set if ($share->getNode() === null) { - throw new \InvalidArgumentException('Path should be set'); + throw new \InvalidArgumentException($this->l->t('Shared path must be set')); } // And it should be a file or a folder - if (!($share->getNode() instanceof \OCP\Files\File) && - !($share->getNode() instanceof \OCP\Files\Folder)) { - throw new \InvalidArgumentException('Path should be either a file or a folder'); + if (!($share->getNode() instanceof \OCP\Files\File) + && !($share->getNode() instanceof \OCP\Files\Folder)) { + throw new \InvalidArgumentException($this->l->t('Shared path must be either a file or a folder')); } - // And you can't share your rootfolder + // And you cannot share your rootfolder if ($this->userManager->userExists($share->getSharedBy())) { $userFolder = $this->rootFolder->getUserFolder($share->getSharedBy()); } else { $userFolder = $this->rootFolder->getUserFolder($share->getShareOwner()); } if ($userFolder->getId() === $share->getNode()->getId()) { - throw new \InvalidArgumentException('You can’t share your root folder'); + throw new \InvalidArgumentException($this->l->t('You cannot share your root folder')); } // Check if we actually have share permissions if (!$share->getNode()->isShareable()) { - $message_t = $this->l->t('You are not allowed to share %s', [$share->getNode()->getName()]); - throw new GenericShareException($message_t, $message_t, 404); + throw new GenericShareException($this->l->t('You are not allowed to share %s', [$share->getNode()->getName()]), code: 404); } // Permissions should be set if ($share->getPermissions() === null) { - throw new \InvalidArgumentException('A share requires permissions'); + throw new \InvalidArgumentException($this->l->t('Valid permissions are required for sharing')); } - $isFederatedShare = $share->getNode()->getStorage()->instanceOfStorage('\OCA\Files_Sharing\External\Storage'); - $permissions = 0; + // Permissions must be valid + if ($share->getPermissions() < 0 || $share->getPermissions() > \OCP\Constants::PERMISSION_ALL) { + throw new \InvalidArgumentException($this->l->t('Valid permissions are required for sharing')); + } - if (!$isFederatedShare && $share->getNode()->getOwner() && $share->getNode()->getOwner()->getUID() !== $share->getSharedBy()) { - $userMounts = array_filter($userFolder->getById($share->getNode()->getId()), function ($mount) { - // We need to filter since there might be other mountpoints that contain the file - // e.g. if the user has access to the same external storage that the file is originating from - return $mount->getStorage()->instanceOfStorage(ISharedStorage::class); - }); - $userMount = array_shift($userMounts); - if ($userMount === null) { - throw new GenericShareException('Could not get proper share mount for ' . $share->getNode()->getId() . '. Failing since else the next calls are called with null'); - } - $mount = $userMount->getMountPoint(); - // When it's a reshare use the parent share permissions as maximum - $userMountPointId = $mount->getStorageRootId(); - $userMountPoints = $userFolder->getById($userMountPointId); - $userMountPoint = array_shift($userMountPoints); - - if ($userMountPoint === null) { - throw new GenericShareException('Could not get proper user mount for ' . $userMountPointId . '. Failing since else the next calls are called with null'); - } - - /* Check if this is an incoming share */ - $incomingShares = $this->getSharedWith($share->getSharedBy(), IShare::TYPE_USER, $userMountPoint, -1, 0); - $incomingShares = array_merge($incomingShares, $this->getSharedWith($share->getSharedBy(), IShare::TYPE_GROUP, $userMountPoint, -1, 0)); - $incomingShares = array_merge($incomingShares, $this->getSharedWith($share->getSharedBy(), IShare::TYPE_CIRCLE, $userMountPoint, -1, 0)); - $incomingShares = array_merge($incomingShares, $this->getSharedWith($share->getSharedBy(), IShare::TYPE_ROOM, $userMountPoint, -1, 0)); - - /** @var IShare[] $incomingShares */ - if (!empty($incomingShares)) { - foreach ($incomingShares as $incomingShare) { - $permissions |= $incomingShare->getPermissions(); - } - } - } else { - /* - * Quick fix for #23536 - * Non moveable mount points do not have update and delete permissions - * while we 'most likely' do have that on the storage. - */ - $permissions = $share->getNode()->getPermissions(); - if (!($share->getNode()->getMountPoint() instanceof MoveableMount)) { - $permissions |= \OCP\Constants::PERMISSION_DELETE | \OCP\Constants::PERMISSION_UPDATE; + // Single file shares should never have delete or create permissions + if (($share->getNode() instanceof File) + && (($share->getPermissions() & (\OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_DELETE)) !== 0)) { + throw new \InvalidArgumentException($this->l->t('File shares cannot have create or delete permissions')); + } + + $permissions = 0; + $nodesForUser = $userFolder->getById($share->getNodeId()); + foreach ($nodesForUser as $node) { + if ($node->getInternalPath() === '' && !$node->getMountPoint() instanceof MoveableMount) { + // for the root of non-movable mount, the permissions we see if limited by the mount itself, + // so we instead use the "raw" permissions from the storage + $permissions |= $node->getStorage()->getPermissions(''); + } else { + $permissions |= $node->getPermissions(); } } // Check that we do not share with more permissions than we have if ($share->getPermissions() & ~$permissions) { $path = $userFolder->getRelativePath($share->getNode()->getPath()); - $message_t = $this->l->t('Can’t increase permissions of %s', [$path]); - throw new GenericShareException($message_t, $message_t, 404); + throw new GenericShareException($this->l->t('Cannot increase permissions of %s', [$path]), code: 404); } - // Check that read permissions are always set // Link shares are allowed to have no read permissions to allow upload to hidden folders $noReadPermissionRequired = $share->getShareType() === IShare::TYPE_LINK || $share->getShareType() === IShare::TYPE_EMAIL; - if (!$noReadPermissionRequired && - ($share->getPermissions() & \OCP\Constants::PERMISSION_READ) === 0) { - throw new \InvalidArgumentException('Shares need at least read permissions'); + if (!$noReadPermissionRequired + && ($share->getPermissions() & \OCP\Constants::PERMISSION_READ) === 0) { + throw new \InvalidArgumentException($this->l->t('Shares need at least read permissions')); } if ($share->getNode() instanceof \OCP\Files\File) { if ($share->getPermissions() & \OCP\Constants::PERMISSION_DELETE) { - $message_t = $this->l->t('Files can’t be shared with delete permissions'); - throw new GenericShareException($message_t); + throw new GenericShareException($this->l->t('Files cannot be shared with delete permissions')); } if ($share->getPermissions() & \OCP\Constants::PERMISSION_CREATE) { - $message_t = $this->l->t('Files can’t be shared with create permissions'); - throw new GenericShareException($message_t); + throw new GenericShareException($this->l->t('Files cannot be shared with create permissions')); } } } @@ -383,51 +278,66 @@ class Manager implements IManager { * @throws \Exception */ protected function validateExpirationDateInternal(IShare $share) { - $expirationDate = $share->getExpirationDate(); + $isRemote = $share->getShareType() === IShare::TYPE_REMOTE || $share->getShareType() === IShare::TYPE_REMOTE_GROUP; - if ($expirationDate !== null) { - //Make sure the expiration date is a date - $expirationDate->setTime(0, 0, 0); + $expirationDate = $share->getExpirationDate(); - $date = new \DateTime(); - $date->setTime(0, 0, 0); - if ($date >= $expirationDate) { - $message = $this->l->t('Expiration date is in the past'); - throw new GenericShareException($message, $message, 404); + if ($isRemote) { + $defaultExpireDate = $this->shareApiRemoteDefaultExpireDate(); + $defaultExpireDays = $this->shareApiRemoteDefaultExpireDays(); + $configProp = 'remote_defaultExpDays'; + $isEnforced = $this->shareApiRemoteDefaultExpireDateEnforced(); + } else { + $defaultExpireDate = $this->shareApiInternalDefaultExpireDate(); + $defaultExpireDays = $this->shareApiInternalDefaultExpireDays(); + $configProp = 'internal_defaultExpDays'; + $isEnforced = $this->shareApiInternalDefaultExpireDateEnforced(); + } + + // If $expirationDate is falsy, noExpirationDate is true and expiration not enforced + // Then skip expiration date validation as null is accepted + if (!$share->getNoExpirationDate() || $isEnforced) { + if ($expirationDate !== null) { + $expirationDate->setTimezone($this->dateTimeZone->getTimeZone()); + $expirationDate->setTime(0, 0, 0); + + $date = new \DateTime('now', $this->dateTimeZone->getTimeZone()); + $date->setTime(0, 0, 0); + if ($date >= $expirationDate) { + throw new GenericShareException($this->l->t('Expiration date is in the past'), code: 404); + } } - } - - // If expiredate is empty set a default one if there is a default - $fullId = null; - try { - $fullId = $share->getFullId(); - } catch (\UnexpectedValueException $e) { - // This is a new share - } - if ($fullId === null && $expirationDate === null && $this->shareApiInternalDefaultExpireDate()) { - $expirationDate = new \DateTime(); - $expirationDate->setTime(0,0,0); - - $days = (int)$this->config->getAppValue('core', 'internal_defaultExpDays', (string)$this->shareApiInternalDefaultExpireDays()); - if ($days > $this->shareApiInternalDefaultExpireDays()) { - $days = $this->shareApiInternalDefaultExpireDays(); + // If expiredate is empty set a default one if there is a default + $fullId = null; + try { + $fullId = $share->getFullId(); + } catch (\UnexpectedValueException $e) { + // This is a new share } - $expirationDate->add(new \DateInterval('P'.$days.'D')); - } - // If we enforce the expiration date check that is does not exceed - if ($this->shareApiInternalDefaultExpireDateEnforced()) { - if ($expirationDate === null) { - throw new \InvalidArgumentException('Expiration date is enforced'); + if ($fullId === null && $expirationDate === null && $defaultExpireDate) { + $expirationDate = new \DateTime('now', $this->dateTimeZone->getTimeZone()); + $expirationDate->setTime(0, 0, 0); + $days = (int)$this->config->getAppValue('core', $configProp, (string)$defaultExpireDays); + if ($days > $defaultExpireDays) { + $days = $defaultExpireDays; + } + $expirationDate->add(new \DateInterval('P' . $days . 'D')); } - $date = new \DateTime(); - $date->setTime(0, 0, 0); - $date->add(new \DateInterval('P' . $this->shareApiInternalDefaultExpireDays() . 'D')); - if ($date < $expirationDate) { - $message = $this->l->t('Can’t set expiration date more than %s days in the future', [$this->shareApiInternalDefaultExpireDays()]); - throw new GenericShareException($message, $message, 404); + // If we enforce the expiration date check that is does not exceed + if ($isEnforced) { + if (empty($expirationDate)) { + throw new \InvalidArgumentException($this->l->t('Expiration date is enforced')); + } + + $date = new \DateTime('now', $this->dateTimeZone->getTimeZone()); + $date->setTime(0, 0, 0); + $date->add(new \DateInterval('P' . $defaultExpireDays . 'D')); + if ($date < $expirationDate) { + throw new GenericShareException($this->l->n('Cannot set expiration date more than %n day in the future', 'Cannot set expiration date more than %n days in the future', $defaultExpireDays), code: 404); + } } } @@ -458,53 +368,60 @@ class Manager implements IManager { * @throws \InvalidArgumentException * @throws \Exception */ - protected function validateExpirationDate(IShare $share) { + protected function validateExpirationDateLink(IShare $share) { $expirationDate = $share->getExpirationDate(); - - if ($expirationDate !== null) { - //Make sure the expiration date is a date - $expirationDate->setTime(0, 0, 0); - - $date = new \DateTime(); - $date->setTime(0, 0, 0); - if ($date >= $expirationDate) { - $message = $this->l->t('Expiration date is in the past'); - throw new GenericShareException($message, $message, 404); + $isEnforced = $this->shareApiLinkDefaultExpireDateEnforced(); + + // If $expirationDate is falsy, noExpirationDate is true and expiration not enforced + // Then skip expiration date validation as null is accepted + if (!($share->getNoExpirationDate() && !$isEnforced)) { + if ($expirationDate !== null) { + $expirationDate->setTimezone($this->dateTimeZone->getTimeZone()); + $expirationDate->setTime(0, 0, 0); + + $date = new \DateTime('now', $this->dateTimeZone->getTimeZone()); + $date->setTime(0, 0, 0); + if ($date >= $expirationDate) { + throw new GenericShareException($this->l->t('Expiration date is in the past'), code: 404); + } } - } - // If expiredate is empty set a default one if there is a default - $fullId = null; - try { - $fullId = $share->getFullId(); - } catch (\UnexpectedValueException $e) { - // This is a new share - } + // If expiredate is empty set a default one if there is a default + $fullId = null; + try { + $fullId = $share->getFullId(); + } catch (\UnexpectedValueException $e) { + // This is a new share + } - if ($fullId === null && $expirationDate === null && $this->shareApiLinkDefaultExpireDate()) { - $expirationDate = new \DateTime(); - $expirationDate->setTime(0,0,0); + if ($fullId === null && $expirationDate === null && $this->shareApiLinkDefaultExpireDate()) { + $expirationDate = new \DateTime('now', $this->dateTimeZone->getTimeZone()); + $expirationDate->setTime(0, 0, 0); - $days = (int)$this->config->getAppValue('core', 'link_defaultExpDays', $this->shareApiLinkDefaultExpireDays()); - if ($days > $this->shareApiLinkDefaultExpireDays()) { - $days = $this->shareApiLinkDefaultExpireDays(); + $days = (int)$this->config->getAppValue('core', 'link_defaultExpDays', (string)$this->shareApiLinkDefaultExpireDays()); + if ($days > $this->shareApiLinkDefaultExpireDays()) { + $days = $this->shareApiLinkDefaultExpireDays(); + } + $expirationDate->add(new \DateInterval('P' . $days . 'D')); } - $expirationDate->add(new \DateInterval('P'.$days.'D')); - } - // If we enforce the expiration date check that is does not exceed - if ($this->shareApiLinkDefaultExpireDateEnforced()) { - if ($expirationDate === null) { - throw new \InvalidArgumentException('Expiration date is enforced'); - } + // If we enforce the expiration date check that is does not exceed + if ($isEnforced) { + if (empty($expirationDate)) { + throw new \InvalidArgumentException($this->l->t('Expiration date is enforced')); + } - $date = new \DateTime(); - $date->setTime(0, 0, 0); - $date->add(new \DateInterval('P' . $this->shareApiLinkDefaultExpireDays() . 'D')); - if ($date < $expirationDate) { - $message = $this->l->t('Can’t set expiration date more than %s days in the future', [$this->shareApiLinkDefaultExpireDays()]); - throw new GenericShareException($message, $message, 404); + $date = new \DateTime('now', $this->dateTimeZone->getTimeZone()); + $date->setTime(0, 0, 0); + $date->add(new \DateInterval('P' . $this->shareApiLinkDefaultExpireDays() . 'D')); + if ($date < $expirationDate) { + throw new GenericShareException( + $this->l->n('Cannot set expiration date more than %n day in the future', 'Cannot set expiration date more than %n days in the future', $this->shareApiLinkDefaultExpireDays()), + code: 404, + ); + } } + } $accepted = true; @@ -538,12 +455,16 @@ class Manager implements IManager { $sharedWith = $this->userManager->get($share->getSharedWith()); // Verify we can share with this user $groups = array_intersect( - $this->groupManager->getUserGroupIds($sharedBy), - $this->groupManager->getUserGroupIds($sharedWith) + $this->groupManager->getUserGroupIds($sharedBy), + $this->groupManager->getUserGroupIds($sharedWith) ); + + // optional excluded groups + $excludedGroups = $this->shareWithGroupMembersOnlyExcludeGroupsList(); + $groups = array_diff($groups, $excludedGroups); + if (empty($groups)) { - $message_t = $this->l->t('Sharing is only allowed with group members'); - throw new \Exception($message_t); + throw new \Exception($this->l->t('Sharing is only allowed with group members')); } } @@ -564,9 +485,9 @@ class Manager implements IManager { //Shares are not identical } - // Identical share already existst + // Identical share already exists if ($existingShare->getSharedWith() === $share->getSharedWith() && $existingShare->getShareType() === $share->getShareType()) { - throw new \Exception('Path is already shared with this user'); + throw new AlreadySharedException($this->l->t('Sharing %s failed, because this item is already shared with the account %s', [$share->getNode()->getName(), $share->getSharedWithDisplayName()]), $existingShare); } // The share is already shared with this user via a group share @@ -576,7 +497,7 @@ class Manager implements IManager { $user = $this->userManager->get($share->getSharedWith()); if ($group->inGroup($user) && $existingShare->getShareOwner() !== $share->getShareOwner()) { - throw new \Exception('Path is already shared with this user'); + throw new AlreadySharedException($this->l->t('Sharing %s failed, because this item is already shared with the account %s', [$share->getNode()->getName(), $share->getSharedWithDisplayName()]), $existingShare); } } } @@ -592,15 +513,18 @@ class Manager implements IManager { protected function groupCreateChecks(IShare $share) { // Verify group shares are allowed if (!$this->allowGroupSharing()) { - throw new \Exception('Group sharing is now allowed'); + throw new \Exception($this->l->t('Group sharing is now allowed')); } // Verify if the user can share with this group if ($this->shareWithGroupMembersOnly()) { $sharedBy = $this->userManager->get($share->getSharedBy()); $sharedWith = $this->groupManager->get($share->getSharedWith()); - if (is_null($sharedWith) || !$sharedWith->inGroup($sharedBy)) { - throw new \Exception('Sharing is only allowed within your own groups'); + + // optional excluded groups + $excludedGroups = $this->shareWithGroupMembersOnlyExcludeGroupsList(); + if (is_null($sharedWith) || in_array($share->getSharedWith(), $excludedGroups) || !$sharedWith->inGroup($sharedBy)) { + throw new \Exception($this->l->t('Sharing is only allowed within your own groups')); } } @@ -621,7 +545,7 @@ class Manager implements IManager { } if ($existingShare->getSharedWith() === $share->getSharedWith() && $existingShare->getShareType() === $share->getShareType()) { - throw new \Exception('Path is already shared with this group'); + throw new AlreadySharedException($this->l->t('Path is already shared with this group'), $existingShare); } } } @@ -635,13 +559,13 @@ class Manager implements IManager { protected function linkCreateChecks(IShare $share) { // Are link shares allowed? if (!$this->shareApiAllowLinks()) { - throw new \Exception('Link sharing is not allowed'); + throw new \Exception($this->l->t('Link sharing is not allowed')); } // Check if public upload is allowed - if (!$this->shareApiLinkAllowPublicUpload() && - ($share->getPermissions() & (\OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_DELETE))) { - throw new \InvalidArgumentException('Public upload is not allowed'); + if ($share->getNodeType() === 'folder' && !$this->shareApiLinkAllowPublicUpload() + && ($share->getPermissions() & (\OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_DELETE))) { + throw new \InvalidArgumentException($this->l->t('Public upload is not allowed')); } } @@ -657,14 +581,10 @@ class Manager implements IManager { * @param IShare $share */ protected function setLinkParent(IShare $share) { - - // No sense in checking if the method is not there. - if (method_exists($share, 'setParent')) { - $storage = $share->getNode()->getStorage(); - if ($storage->instanceOfStorage('\OCA\Files_Sharing\ISharedStorage')) { - /** @var \OCA\Files_Sharing\SharedStorage $storage */ - $share->setParent($storage->getShareId()); - } + $storage = $share->getNode()->getStorage(); + if ($storage->instanceOfStorage(SharedStorage::class)) { + /** @var \OCA\Files_Sharing\SharedStorage $storage */ + $share->setParent((int)$storage->getShareId()); } } @@ -677,7 +597,11 @@ class Manager implements IManager { $mounts = $this->mountManager->findIn($path->getPath()); foreach ($mounts as $mount) { if ($mount->getStorage()->instanceOfStorage('\OCA\Files_Sharing\ISharedStorage')) { - throw new \InvalidArgumentException('Path contains files shared with you'); + // Using a flat sharing model ensures the file owner can always see who has access. + // Allowing parent folder sharing would require tracking inherited access, which adds complexity + // and hurts performance/scalability. + // So we forbid sharing a parent folder of a share you received. + throw new \InvalidArgumentException($this->l->t('You cannot share a folder that contains other shares')); } } } @@ -691,11 +615,11 @@ class Manager implements IManager { */ protected function canShare(IShare $share) { if (!$this->shareApiEnabled()) { - throw new \Exception('Sharing is disabled'); + throw new \Exception($this->l->t('Sharing is disabled')); } if ($this->sharingDisabledForUser($share->getSharedBy())) { - throw new \Exception('Sharing is disabled for you'); + throw new \Exception($this->l->t('Sharing is disabled for you')); } } @@ -735,196 +659,110 @@ class Manager implements IManager { } } - //Verify share type - if ($share->getShareType() === IShare::TYPE_USER) { - $this->userCreateChecks($share); - - //Verify the expiration date - $share = $this->validateExpirationDateInternal($share); - } elseif ($share->getShareType() === IShare::TYPE_GROUP) { - $this->groupCreateChecks($share); - - //Verify the expiration date - $share = $this->validateExpirationDateInternal($share); - } elseif ($share->getShareType() === IShare::TYPE_LINK) { - $this->linkCreateChecks($share); - $this->setLinkParent($share); + try { + // Verify share type + if ($share->getShareType() === IShare::TYPE_USER) { + $this->userCreateChecks($share); + + // Verify the expiration date + $share = $this->validateExpirationDateInternal($share); + } elseif ($share->getShareType() === IShare::TYPE_GROUP) { + $this->groupCreateChecks($share); + + // Verify the expiration date + $share = $this->validateExpirationDateInternal($share); + } elseif ($share->getShareType() === IShare::TYPE_REMOTE || $share->getShareType() === IShare::TYPE_REMOTE_GROUP) { + // Verify the expiration date + $share = $this->validateExpirationDateInternal($share); + } elseif ($share->getShareType() === IShare::TYPE_LINK + || $share->getShareType() === IShare::TYPE_EMAIL) { + $this->linkCreateChecks($share); + $this->setLinkParent($share); + + $token = $this->generateToken(); + // Set the unique token + $share->setToken($token); + + // Verify the expiration date + $share = $this->validateExpirationDateLink($share); + + // Verify the password + $this->verifyPassword($share->getPassword()); + + // If a password is set. Hash it! + if ($share->getShareType() === IShare::TYPE_LINK + && $share->getPassword() !== null) { + $share->setPassword($this->hasher->hash($share->getPassword())); + } + } - /* - * For now ignore a set token. - */ - $share->setToken( - $this->secureRandom->generate( - \OC\Share\Constants::TOKEN_LENGTH, - \OCP\Security\ISecureRandom::CHAR_HUMAN_READABLE - ) - ); + // Cannot share with the owner + if ($share->getShareType() === IShare::TYPE_USER + && $share->getSharedWith() === $share->getShareOwner()) { + throw new \InvalidArgumentException($this->l->t('Cannot share with the share owner')); + } - //Verify the expiration date - $share = $this->validateExpirationDate($share); + // Generate the target + $shareFolder = $this->config->getSystemValue('share_folder', '/'); + if ($share->getShareType() === IShare::TYPE_USER) { + $allowCustomShareFolder = $this->config->getSystemValueBool('sharing.allow_custom_share_folder', true); + if ($allowCustomShareFolder) { + $shareFolder = $this->config->getUserValue($share->getSharedWith(), Application::APP_ID, 'share_folder', $shareFolder); + } + } - //Verify the password - $this->verifyPassword($share->getPassword()); + $target = $shareFolder . '/' . $share->getNode()->getName(); + $target = \OC\Files\Filesystem::normalizePath($target); + $share->setTarget($target); - // If a password is set. Hash it! - if ($share->getPassword() !== null) { - $share->setPassword($this->hasher->hash($share->getPassword())); + // Pre share event + $event = new Share\Events\BeforeShareCreatedEvent($share); + $this->dispatcher->dispatchTyped($event); + if ($event->isPropagationStopped() && $event->getError()) { + throw new \Exception($event->getError()); } - } elseif ($share->getShareType() === IShare::TYPE_EMAIL) { - $share->setToken( - $this->secureRandom->generate( - \OC\Share\Constants::TOKEN_LENGTH, - \OCP\Security\ISecureRandom::CHAR_HUMAN_READABLE - ) - ); - } - - // Cannot share with the owner - if ($share->getShareType() === IShare::TYPE_USER && - $share->getSharedWith() === $share->getShareOwner()) { - throw new \InvalidArgumentException('Can’t share with the share owner'); - } - // Generate the target - $target = $this->config->getSystemValue('share_folder', '/') .'/'. $share->getNode()->getName(); - $target = \OC\Files\Filesystem::normalizePath($target); - $share->setTarget($target); + $oldShare = $share; + $provider = $this->factory->getProviderForType($share->getShareType()); + $share = $provider->create($share); - // Pre share event - $event = new GenericEvent($share); - $this->legacyDispatcher->dispatch('OCP\Share::preShare', $event); - if ($event->isPropagationStopped() && $event->hasArgument('error')) { - throw new \Exception($event->getArgument('error')); - } + // Reuse the node we already have + $share->setNode($oldShare->getNode()); - $oldShare = $share; - $provider = $this->factory->getProviderForType($share->getShareType()); - $share = $provider->create($share); - //reuse the node we already have - $share->setNode($oldShare->getNode()); + // Reset the target if it is null for the new share + if ($share->getTarget() === '') { + $share->setTarget($target); + } + } catch (AlreadySharedException $e) { + // If a share for the same target already exists, dont create a new one, + // but do trigger the hooks and notifications again + $oldShare = $share; - // Reset the target if it is null for the new share - if ($share->getTarget() === '') { - $share->setTarget($target); + // Reuse the node we already have + $share = $e->getExistingShare(); + $share->setNode($oldShare->getNode()); } // Post share event - $event = new GenericEvent($share); - $this->legacyDispatcher->dispatch('OCP\Share::postShare', $event); - - $this->dispatcher->dispatchTyped(new Share\Events\ShareCreatedEvent($share)); - - if ($this->config->getSystemValueBool('sharing.enable_share_mail', true) - && $share->getShareType() === IShare::TYPE_USER) { - $mailSend = $share->getMailSend(); - if ($mailSend === true) { - $user = $this->userManager->get($share->getSharedWith()); - if ($user !== null) { - $emailAddress = $user->getEMailAddress(); - if ($emailAddress !== null && $emailAddress !== '') { - $userLang = $this->l10nFactory->getUserLanguage($user); - $l = $this->l10nFactory->get('lib', $userLang); - $this->sendMailNotification( - $l, - $share->getNode()->getName(), - $this->urlGenerator->linkToRouteAbsolute('files_sharing.Accept.accept', ['shareId' => $share->getFullId()]), - $share->getSharedBy(), - $emailAddress, - $share->getExpirationDate() - ); - $this->logger->debug('Sent share notification to ' . $emailAddress . ' for share with ID ' . $share->getId(), ['app' => 'share']); - } else { - $this->logger->debug('Share notification not sent to ' . $share->getSharedWith() . ' because email address is not set.', ['app' => 'share']); - } + $this->dispatcher->dispatchTyped(new ShareCreatedEvent($share)); + + // Send email if needed + if ($this->config->getSystemValueBool('sharing.enable_share_mail', true)) { + if ($share->getMailSend()) { + $provider = $this->factory->getProviderForType($share->getShareType()); + if ($provider instanceof IShareProviderWithNotification) { + $provider->sendMailNotification($share); } else { - $this->logger->debug('Share notification not sent to ' . $share->getSharedWith() . ' because user could not be found.', ['app' => 'share']); + $this->logger->debug('Share notification not sent because the provider does not support it.', ['app' => 'share']); } } else { $this->logger->debug('Share notification not sent because mailsend is false.', ['app' => 'share']); } - } - - return $share; - } - - /** - * Send mail notifications - * - * This method will catch and log mail transmission errors - * - * @param IL10N $l Language of the recipient - * @param string $filename file/folder name - * @param string $link link to the file/folder - * @param string $initiator user ID of share sender - * @param string $shareWith email address of share receiver - * @param \DateTime|null $expiration - */ - protected function sendMailNotification(IL10N $l, - $filename, - $link, - $initiator, - $shareWith, - \DateTime $expiration = null) { - $initiatorUser = $this->userManager->get($initiator); - $initiatorDisplayName = ($initiatorUser instanceof IUser) ? $initiatorUser->getDisplayName() : $initiator; - - $message = $this->mailer->createMessage(); - - $emailTemplate = $this->mailer->createEMailTemplate('files_sharing.RecipientNotification', [ - 'filename' => $filename, - 'link' => $link, - 'initiator' => $initiatorDisplayName, - 'expiration' => $expiration, - 'shareWith' => $shareWith, - ]); - - $emailTemplate->setSubject($l->t('%1$s shared »%2$s« with you', [$initiatorDisplayName, $filename])); - $emailTemplate->addHeader(); - $emailTemplate->addHeading($l->t('%1$s shared »%2$s« with you', [$initiatorDisplayName, $filename]), false); - $text = $l->t('%1$s shared »%2$s« with you.', [$initiatorDisplayName, $filename]); - - $emailTemplate->addBodyText( - htmlspecialchars($text . ' ' . $l->t('Click the button below to open it.')), - $text - ); - $emailTemplate->addBodyButton( - $l->t('Open »%s«', [$filename]), - $link - ); - - $message->setTo([$shareWith]); - - // The "From" contains the sharers name - $instanceName = $this->defaults->getName(); - $senderName = $l->t( - '%1$s via %2$s', - [ - $initiatorDisplayName, - $instanceName - ] - ); - $message->setFrom([\OCP\Util::getDefaultEmailAddress($instanceName) => $senderName]); - - // The "Reply-To" is set to the sharer if an mail address is configured - // also the default footer contains a "Do not reply" which needs to be adjusted. - $initiatorEmail = $initiatorUser->getEMailAddress(); - if ($initiatorEmail !== null) { - $message->setReplyTo([$initiatorEmail => $initiatorDisplayName]); - $emailTemplate->addFooter($instanceName . ($this->defaults->getSlogan($l->getLanguageCode()) !== '' ? ' - ' . $this->defaults->getSlogan($l->getLanguageCode()) : '')); } else { - $emailTemplate->addFooter('', $l->getLanguageCode()); + $this->logger->debug('Share notification not sent because sharing notification emails is disabled.', ['app' => 'share']); } - $message->useTemplate($emailTemplate); - try { - $failedRecipients = $this->mailer->send($message); - if (!empty($failedRecipients)) { - $this->logger->error('Share notification mail could not be sent to: ' . implode(', ', $failedRecipients)); - return; - } - } catch (\Exception $e) { - $this->logger->logException($e, ['message' => 'Share notification mail could not be sent']); - } + return $share; } /** @@ -933,83 +771,95 @@ class Manager implements IManager { * @param IShare $share * @return IShare The share object * @throws \InvalidArgumentException + * @throws HintException */ - public function updateShare(IShare $share) { + public function updateShare(IShare $share, bool $onlyValid = true) { $expirationDateUpdated = false; $this->canShare($share); try { - $originalShare = $this->getShareById($share->getFullId()); + $originalShare = $this->getShareById($share->getFullId(), onlyValid: $onlyValid); } catch (\UnexpectedValueException $e) { - throw new \InvalidArgumentException('Share does not have a full id'); + throw new \InvalidArgumentException($this->l->t('Share does not have a full ID')); } - // We can't change the share type! + // We cannot change the share type! if ($share->getShareType() !== $originalShare->getShareType()) { - throw new \InvalidArgumentException('Can’t change share type'); + throw new \InvalidArgumentException($this->l->t('Cannot change share type')); } // We can only change the recipient on user shares - if ($share->getSharedWith() !== $originalShare->getSharedWith() && - $share->getShareType() !== IShare::TYPE_USER) { - throw new \InvalidArgumentException('Can only update recipient on user shares'); + if ($share->getSharedWith() !== $originalShare->getSharedWith() + && $share->getShareType() !== IShare::TYPE_USER) { + throw new \InvalidArgumentException($this->l->t('Can only update recipient on user shares')); } // Cannot share with the owner - if ($share->getShareType() === IShare::TYPE_USER && - $share->getSharedWith() === $share->getShareOwner()) { - throw new \InvalidArgumentException('Can’t share with the share owner'); + if ($share->getShareType() === IShare::TYPE_USER + && $share->getSharedWith() === $share->getShareOwner()) { + throw new \InvalidArgumentException($this->l->t('Cannot share with the share owner')); } - $this->generalCreateChecks($share); + $this->generalCreateChecks($share, true); if ($share->getShareType() === IShare::TYPE_USER) { $this->userCreateChecks($share); if ($share->getExpirationDate() != $originalShare->getExpirationDate()) { - //Verify the expiration date - $this->validateExpirationDate($share); + // Verify the expiration date + $this->validateExpirationDateInternal($share); $expirationDateUpdated = true; } } elseif ($share->getShareType() === IShare::TYPE_GROUP) { $this->groupCreateChecks($share); if ($share->getExpirationDate() != $originalShare->getExpirationDate()) { - //Verify the expiration date - $this->validateExpirationDate($share); + // Verify the expiration date + $this->validateExpirationDateInternal($share); $expirationDateUpdated = true; } - } elseif ($share->getShareType() === IShare::TYPE_LINK) { + } elseif ($share->getShareType() === IShare::TYPE_LINK + || $share->getShareType() === IShare::TYPE_EMAIL) { $this->linkCreateChecks($share); + // The new password is not set again if it is the same as the old + // one, unless when switching from sending by Talk to sending by + // mail. $plainTextPassword = $share->getPassword(); + $updatedPassword = $this->updateSharePasswordIfNeeded($share, $originalShare); - $this->updateSharePasswordIfNeeded($share, $originalShare); - + /** + * Cannot enable the getSendPasswordByTalk if there is no password set + */ if (empty($plainTextPassword) && $share->getSendPasswordByTalk()) { - throw new \InvalidArgumentException('Can’t enable sending the password by Talk with an empty password'); + throw new \InvalidArgumentException($this->l->t('Cannot enable sending the password by Talk with an empty password')); + } + + /** + * If we're in a mail share, we need to force a password change + * as either the user is not aware of the password or is already (received by mail) + * Thus the SendPasswordByTalk feature would not make sense + */ + if (!$updatedPassword && $share->getShareType() === IShare::TYPE_EMAIL) { + if (!$originalShare->getSendPasswordByTalk() && $share->getSendPasswordByTalk()) { + throw new \InvalidArgumentException($this->l->t('Cannot enable sending the password by Talk without setting a new password')); + } + if ($originalShare->getSendPasswordByTalk() && !$share->getSendPasswordByTalk()) { + throw new \InvalidArgumentException($this->l->t('Cannot disable sending the password by Talk without setting a new password')); + } } if ($share->getExpirationDate() != $originalShare->getExpirationDate()) { - //Verify the expiration date - $this->validateExpirationDate($share); + // Verify the expiration date + $this->validateExpirationDateLink($share); $expirationDateUpdated = true; } - } elseif ($share->getShareType() === IShare::TYPE_EMAIL) { - // The new password is not set again if it is the same as the old - // one. - $plainTextPassword = $share->getPassword(); - if (!empty($plainTextPassword) && !$this->updateSharePasswordIfNeeded($share, $originalShare)) { - $plainTextPassword = null; - } - if (empty($plainTextPassword) && !$originalShare->getSendPasswordByTalk() && $share->getSendPasswordByTalk()) { - // If the same password was already sent by mail the recipient - // would already have access to the share without having to call - // the sharer to verify her identity - throw new \InvalidArgumentException('Can’t enable sending the password by Talk without setting a new password'); - } elseif (empty($plainTextPassword) && $originalShare->getSendPasswordByTalk() && !$share->getSendPasswordByTalk()) { - throw new \InvalidArgumentException('Can’t disable sending the password by Talk without setting a new password'); + } elseif ($share->getShareType() === IShare::TYPE_REMOTE || $share->getShareType() === IShare::TYPE_REMOTE_GROUP) { + if ($share->getExpirationDate() != $originalShare->getExpirationDate()) { + // Verify the expiration date + $this->validateExpirationDateInternal($share); + $expirationDateUpdated = true; } } @@ -1018,6 +868,7 @@ class Manager implements IManager { // Now update the share! $provider = $this->factory->getProviderForType($share->getShareType()); if ($share->getShareType() === IShare::TYPE_EMAIL) { + /** @var ShareByMailProvider $provider */ $share = $provider->update($share, $plainTextPassword); } else { $share = $provider->update($share); @@ -1055,6 +906,7 @@ class Manager implements IManager { 'shareWith' => $share->getSharedWith(), 'uidOwner' => $share->getSharedBy(), 'permissions' => $share->getPermissions(), + 'attributes' => $share->getAttributes() !== null ? $share->getAttributes()->toArray() : null, 'path' => $userFolder->getRelativePath($share->getNode()->getPath()), ]); } @@ -1068,20 +920,21 @@ class Manager implements IManager { * @param IShare $share * @param string $recipientId * @return IShare The share object - * @throws \InvalidArgumentException + * @throws \InvalidArgumentException Thrown if the provider does not implement `IShareProviderSupportsAccept` * @since 9.0.0 */ public function acceptShare(IShare $share, string $recipientId): IShare { - [$providerId, ] = $this->splitFullId($share->getFullId()); + [$providerId,] = $this->splitFullId($share->getFullId()); $provider = $this->factory->getProvider($providerId); - if (!method_exists($provider, 'acceptShare')) { - // TODO FIX ME - throw new \InvalidArgumentException('Share provider does not support accepting'); + if (!($provider instanceof IShareProviderSupportsAccept)) { + throw new \InvalidArgumentException($this->l->t('Share provider does not support accepting')); } + /** @var IShareProvider&IShareProviderSupportsAccept $provider */ $provider->acceptShare($share, $recipientId); - $event = new GenericEvent($share); - $this->legacyDispatcher->dispatch('OCP\Share::postAcceptShare', $event); + + $event = new ShareAcceptedEvent($share); + $this->dispatcher->dispatchTyped($event); return $share; } @@ -1092,26 +945,37 @@ class Manager implements IManager { * * @param IShare $share the share to update its password. * @param IShare $originalShare the original share to compare its - * password with. + * password with. * @return boolean whether the password was updated or not. */ private function updateSharePasswordIfNeeded(IShare $share, IShare $originalShare) { - $passwordsAreDifferent = ($share->getPassword() !== $originalShare->getPassword()) && - (($share->getPassword() !== null && $originalShare->getPassword() === null) || - ($share->getPassword() === null && $originalShare->getPassword() !== null) || - ($share->getPassword() !== null && $originalShare->getPassword() !== null && - !$this->hasher->verify($share->getPassword(), $originalShare->getPassword()))); + $passwordsAreDifferent = ($share->getPassword() !== $originalShare->getPassword()) + && (($share->getPassword() !== null && $originalShare->getPassword() === null) + || ($share->getPassword() === null && $originalShare->getPassword() !== null) + || ($share->getPassword() !== null && $originalShare->getPassword() !== null + && !$this->hasher->verify($share->getPassword(), $originalShare->getPassword()))); // Password updated. if ($passwordsAreDifferent) { - //Verify the password + // Verify the password $this->verifyPassword($share->getPassword()); // If a password is set. Hash it! - if ($share->getPassword() !== null) { + if (!empty($share->getPassword())) { $share->setPassword($this->hasher->hash($share->getPassword())); + if ($share->getShareType() === IShare::TYPE_EMAIL) { + // Shares shared by email have temporary passwords + $this->setSharePasswordExpirationTime($share); + } return true; + } else { + // Empty string and null are seen as NOT password protected + $share->setPassword(null); + if ($share->getShareType() === IShare::TYPE_EMAIL) { + $share->setPasswordExpirationTime(null); + } + return true; } } else { // Reset the password to the original one, as it is either the same @@ -1123,8 +987,25 @@ class Manager implements IManager { } /** + * Set the share's password expiration time + */ + private function setSharePasswordExpirationTime(IShare $share): void { + if (!$this->config->getSystemValueBool('sharing.enable_mail_link_password_expiration', false)) { + // Sets password expiration date to NULL + $share->setPasswordExpirationTime(); + return; + } + // Sets password expiration date + $expirationTime = null; + $now = new \DateTime(); + $expirationInterval = $this->config->getSystemValue('sharing.mail_link_password_expiration_interval', 3600); + $expirationTime = $now->add(new \DateInterval('PT' . $expirationInterval . 'S')); + $share->setPasswordExpirationTime($expirationTime); + } + + + /** * Delete all the children of this share - * FIXME: remove once https://github.com/owncloud/core/pull/21660 is in * * @param IShare $share * @return IShare[] List of deleted shares @@ -1135,17 +1016,107 @@ class Manager implements IManager { $provider = $this->factory->getProviderForType($share->getShareType()); foreach ($provider->getChildren($share) as $child) { + $this->dispatcher->dispatchTyped(new BeforeShareDeletedEvent($child)); + $deletedChildren = $this->deleteChildren($child); $deletedShares = array_merge($deletedShares, $deletedChildren); $provider->delete($child); - $this->dispatcher->dispatchTyped(new Share\Events\ShareDeletedEvent($child)); + $this->dispatcher->dispatchTyped(new ShareDeletedEvent($child)); $deletedShares[] = $child; } return $deletedShares; } + /** Promote re-shares into direct shares so that target user keeps access */ + protected function promoteReshares(IShare $share): void { + try { + $node = $share->getNode(); + } catch (NotFoundException) { + /* Skip if node not found */ + return; + } + + $userIds = []; + + if ($share->getShareType() === IShare::TYPE_USER) { + $userIds[] = $share->getSharedWith(); + } elseif ($share->getShareType() === IShare::TYPE_GROUP) { + $group = $this->groupManager->get($share->getSharedWith()); + $users = $group?->getUsers() ?? []; + + foreach ($users as $user) { + /* Skip share owner */ + if ($user->getUID() === $share->getShareOwner() || $user->getUID() === $share->getSharedBy()) { + continue; + } + $userIds[] = $user->getUID(); + } + } else { + /* We only support user and group shares */ + return; + } + + $reshareRecords = []; + $shareTypes = [ + IShare::TYPE_GROUP, + IShare::TYPE_USER, + IShare::TYPE_LINK, + IShare::TYPE_REMOTE, + IShare::TYPE_EMAIL, + ]; + + foreach ($userIds as $userId) { + foreach ($shareTypes as $shareType) { + try { + $provider = $this->factory->getProviderForType($shareType); + } catch (ProviderException $e) { + continue; + } + + if ($node instanceof Folder) { + /* We need to get all shares by this user to get subshares */ + $shares = $provider->getSharesBy($userId, $shareType, null, false, -1, 0); + + foreach ($shares as $share) { + try { + $path = $share->getNode()->getPath(); + } catch (NotFoundException) { + /* Ignore share of non-existing node */ + continue; + } + if ($node->getRelativePath($path) !== null) { + /* If relative path is not null it means the shared node is the same or in a subfolder */ + $reshareRecords[] = $share; + } + } + } else { + $shares = $provider->getSharesBy($userId, $shareType, $node, false, -1, 0); + foreach ($shares as $child) { + $reshareRecords[] = $child; + } + } + } + } + + foreach ($reshareRecords as $child) { + try { + /* Check if the share is still valid (means the resharer still has access to the file through another mean) */ + $this->generalCreateChecks($child); + } catch (GenericShareException $e) { + /* The check is invalid, promote it to a direct share from the sharer of parent share */ + $this->logger->debug('Promote reshare because of exception ' . $e->getMessage(), ['exception' => $e, 'fullId' => $child->getFullId()]); + try { + $child->setSharedBy($share->getSharedBy()); + $this->updateShare($child); + } catch (GenericShareException|\InvalidArgumentException $e) { + $this->logger->warning('Failed to promote reshare because of exception ' . $e->getMessage(), ['exception' => $e, 'fullId' => $child->getFullId()]); + } + } + } + } + /** * Delete a share * @@ -1157,27 +1128,22 @@ class Manager implements IManager { try { $share->getFullId(); } catch (\UnexpectedValueException $e) { - throw new \InvalidArgumentException('Share does not have a full id'); + throw new \InvalidArgumentException($this->l->t('Share does not have a full ID')); } - $event = new GenericEvent($share); - $this->legacyDispatcher->dispatch('OCP\Share::preUnshare', $event); + $this->dispatcher->dispatchTyped(new BeforeShareDeletedEvent($share)); // Get all children and delete them as well - $deletedShares = $this->deleteChildren($share); + $this->deleteChildren($share); // Do the actual delete $provider = $this->factory->getProviderForType($share->getShareType()); $provider->delete($share); - $this->dispatcher->dispatchTyped(new Share\Events\ShareDeletedEvent($share)); - - // All the deleted shares caused by this delete - $deletedShares[] = $share; + $this->dispatcher->dispatchTyped(new ShareDeletedEvent($share)); - // Emit post hook - $event->setArgument('deletedShares', $deletedShares); - $this->legacyDispatcher->dispatch('OCP\Share::postUnshare', $event); + // Promote reshares of the deleted share + $this->promoteReshares($share); } @@ -1191,16 +1157,16 @@ class Manager implements IManager { * @param string $recipientId */ public function deleteFromSelf(IShare $share, $recipientId) { - list($providerId, ) = $this->splitFullId($share->getFullId()); + [$providerId,] = $this->splitFullId($share->getFullId()); $provider = $this->factory->getProvider($providerId); $provider->deleteFromSelf($share, $recipientId); - $event = new GenericEvent($share); - $this->legacyDispatcher->dispatch('OCP\Share::postUnshareFromSelf', $event); + $event = new ShareDeletedFromSelfEvent($share); + $this->dispatcher->dispatchTyped($event); } public function restoreShare(IShare $share, string $recipientId): IShare { - list($providerId, ) = $this->splitFullId($share->getFullId()); + [$providerId,] = $this->splitFullId($share->getFullId()); $provider = $this->factory->getProvider($providerId); return $provider->restore($share, $recipientId); @@ -1210,55 +1176,70 @@ class Manager implements IManager { * @inheritdoc */ public function moveShare(IShare $share, $recipientId) { - if ($share->getShareType() === IShare::TYPE_LINK) { - throw new \InvalidArgumentException('Can’t change target of link share'); + if ($share->getShareType() === IShare::TYPE_LINK + || $share->getShareType() === IShare::TYPE_EMAIL) { + throw new \InvalidArgumentException($this->l->t('Cannot change target of link share')); } if ($share->getShareType() === IShare::TYPE_USER && $share->getSharedWith() !== $recipientId) { - throw new \InvalidArgumentException('Invalid recipient'); + throw new \InvalidArgumentException($this->l->t('Invalid share recipient')); } if ($share->getShareType() === IShare::TYPE_GROUP) { $sharedWith = $this->groupManager->get($share->getSharedWith()); if (is_null($sharedWith)) { - throw new \InvalidArgumentException('Group "' . $share->getSharedWith() . '" does not exist'); + throw new \InvalidArgumentException($this->l->t('Group "%s" does not exist', [$share->getSharedWith()])); } $recipient = $this->userManager->get($recipientId); if (!$sharedWith->inGroup($recipient)) { - throw new \InvalidArgumentException('Invalid recipient'); + throw new \InvalidArgumentException($this->l->t('Invalid share recipient')); } } - list($providerId, ) = $this->splitFullId($share->getFullId()); + [$providerId,] = $this->splitFullId($share->getFullId()); $provider = $this->factory->getProvider($providerId); return $provider->move($share, $recipientId); } - public function getSharesInFolder($userId, Folder $node, $reshares = false) { + public function getSharesInFolder($userId, Folder $node, $reshares = false, $shallow = true) { $providers = $this->factory->getAllProviders(); + if (!$shallow) { + throw new \Exception('non-shallow getSharesInFolder is no longer supported'); + } - return array_reduce($providers, function ($shares, IShareProvider $provider) use ($userId, $node, $reshares) { - $newShares = $provider->getSharesInFolder($userId, $node, $reshares); - foreach ($newShares as $fid => $data) { - if (!isset($shares[$fid])) { - $shares[$fid] = []; - } + $isOwnerless = $node->getMountPoint() instanceof IShareOwnerlessMount; - $shares[$fid] = array_merge($shares[$fid], $data); + $shares = []; + foreach ($providers as $provider) { + if ($isOwnerless) { + // If the provider does not implement the additional interface, + // we lack a performant way of querying all shares and therefore ignore the provider. + if ($provider instanceof IShareProviderSupportsAllSharesInFolder) { + foreach ($provider->getAllSharesInFolder($node) as $fid => $data) { + $shares[$fid] ??= []; + $shares[$fid] = array_merge($shares[$fid], $data); + } + } + } else { + foreach ($provider->getSharesInFolder($userId, $node, $reshares) as $fid => $data) { + $shares[$fid] ??= []; + $shares[$fid] = array_merge($shares[$fid], $data); + } } - return $shares; - }, []); + } + + return $shares; } /** * @inheritdoc */ - public function getSharesBy($userId, $shareType, $path = null, $reshares = false, $limit = 50, $offset = 0) { - if ($path !== null && - !($path instanceof \OCP\Files\File) && - !($path instanceof \OCP\Files\Folder)) { - throw new \InvalidArgumentException('invalid path'); + public function getSharesBy($userId, $shareType, $path = null, $reshares = false, $limit = 50, $offset = 0, bool $onlyValid = true) { + if ($path !== null + && !($path instanceof \OCP\Files\File) + && !($path instanceof \OCP\Files\Folder)) { + throw new \InvalidArgumentException($this->l->t('Invalid path')); } try { @@ -1267,7 +1248,11 @@ class Manager implements IManager { return []; } - $shares = $provider->getSharesBy($userId, $shareType, $path, $reshares, $limit, $offset); + if ($path?->getMountPoint() instanceof IShareOwnerlessMount) { + $shares = array_filter($provider->getSharesByPath($path), static fn (IShare $share) => $share->getShareType() === $shareType); + } else { + $shares = $provider->getSharesBy($userId, $shareType, $path, $reshares, $limit, $offset); + } /* * Work around so we don't return expired shares but still follow @@ -1279,11 +1264,13 @@ class Manager implements IManager { while (true) { $added = 0; foreach ($shares as $share) { - try { - $this->checkExpireDate($share); - } catch (ShareNotFound $e) { - //Ignore since this basically means the share is deleted - continue; + if ($onlyValid) { + try { + $this->checkShare($share); + } catch (ShareNotFound $e) { + // Ignore since this basically means the share is deleted + continue; + } } $added++; @@ -1311,7 +1298,12 @@ class Manager implements IManager { $offset += $added; // Fetch again $limit shares - $shares = $provider->getSharesBy($userId, $shareType, $path, $reshares, $limit, $offset); + if ($path?->getMountPoint() instanceof IShareOwnerlessMount) { + // We already fetched all shares, so end here + $shares = []; + } else { + $shares = $provider->getSharesBy($userId, $shareType, $path, $reshares, $limit, $offset); + } // No more shares means we are done if (empty($shares)) { @@ -1339,7 +1331,7 @@ class Manager implements IManager { // remove all shares which are already expired foreach ($shares as $key => $share) { try { - $this->checkExpireDate($share); + $this->checkShare($share); } catch (ShareNotFound $e) { unset($shares[$key]); } @@ -1370,12 +1362,12 @@ class Manager implements IManager { /** * @inheritdoc */ - public function getShareById($id, $recipient = null) { + public function getShareById($id, $recipient = null, bool $onlyValid = true) { if ($id === null) { throw new ShareNotFound(); } - list($providerId, $id) = $this->splitFullId($id); + [$providerId, $id] = $this->splitFullId($id); try { $provider = $this->factory->getProvider($providerId); @@ -1385,7 +1377,9 @@ class Manager implements IManager { $share = $provider->getShareById($id, $recipient); - $this->checkExpireDate($share); + if ($onlyValid) { + $this->checkShare($share); + } return $share; } @@ -1412,7 +1406,7 @@ class Manager implements IManager { * @throws ShareNotFound */ public function getShareByToken($token) { - // tokens can't be valid local user names + // tokens cannot be valid local user names if ($this->userManager->userExists($token)) { throw new ShareNotFound(); } @@ -1469,43 +1463,57 @@ class Manager implements IManager { throw new ShareNotFound($this->l->t('The requested share does not exist anymore')); } - $this->checkExpireDate($share); + $this->checkShare($share); /* - * Reduce the permissions for link shares if public upload is not enabled + * Reduce the permissions for link or email shares if public upload is not enabled */ - if ($share->getShareType() === IShare::TYPE_LINK && - !$this->shareApiLinkAllowPublicUpload()) { + if (($share->getShareType() === IShare::TYPE_LINK || $share->getShareType() === IShare::TYPE_EMAIL) + && $share->getNodeType() === 'folder' && !$this->shareApiLinkAllowPublicUpload()) { $share->setPermissions($share->getPermissions() & ~(\OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE)); } return $share; } - protected function checkExpireDate($share) { + /** + * Check expire date and disabled owner + * + * @throws ShareNotFound + */ + protected function checkShare(IShare $share): void { if ($share->isExpired()) { $this->deleteShare($share); throw new ShareNotFound($this->l->t('The requested share does not exist anymore')); } + if ($this->config->getAppValue('files_sharing', 'hide_disabled_user_shares', 'no') === 'yes') { + $uids = array_unique([$share->getShareOwner(),$share->getSharedBy()]); + foreach ($uids as $uid) { + $user = $this->userManager->get($uid); + if ($user?->isEnabled() === false) { + throw new ShareNotFound($this->l->t('The requested share comes from a disabled user')); + } + } + } } /** * Verify the password of a public share * * @param IShare $share - * @param string $password + * @param ?string $password * @return bool */ public function checkPassword(IShare $share, $password) { - $passwordProtected = $share->getShareType() !== IShare::TYPE_LINK - || $share->getShareType() !== IShare::TYPE_EMAIL - || $share->getShareType() !== IShare::TYPE_CIRCLE; - if (!$passwordProtected) { - //TODO maybe exception? + + // if there is no password on the share object / passsword is null, there is nothing to check + if ($password === null || $share->getPassword() === null) { return false; } - if ($password === null || $share->getPassword() === null) { + // Makes sure password hasn't expired + $expirationTime = $share->getPasswordExpirationTime(); + if ($expirationTime !== null && $expirationTime < new \DateTime()) { return false; } @@ -1543,8 +1551,14 @@ class Manager implements IManager { * @inheritdoc */ public function groupDeleted($gid) { - $provider = $this->factory->getProviderForType(IShare::TYPE_GROUP); - $provider->groupDeleted($gid); + foreach ([IShare::TYPE_GROUP, IShare::TYPE_REMOTE_GROUP] as $type) { + try { + $provider = $this->factory->getProviderForType($type); + } catch (ProviderException $e) { + continue; + } + $provider->groupDeleted($gid); + } $excludedGroups = $this->config->getAppValue('core', 'shareapi_exclude_groups_list', ''); if ($excludedGroups === '') { @@ -1564,8 +1578,14 @@ class Manager implements IManager { * @inheritdoc */ public function userDeletedFromGroup($uid, $gid) { - $provider = $this->factory->getProviderForType(IShare::TYPE_GROUP); - $provider->userDeletedFromGroup($uid, $gid); + foreach ([IShare::TYPE_GROUP, IShare::TYPE_REMOTE_GROUP] as $type) { + try { + $provider = $this->factory->getProviderForType($type); + } catch (ProviderException $e) { + continue; + } + $provider->userDeletedFromGroup($uid, $gid); + } } /** @@ -1578,9 +1598,10 @@ class Manager implements IManager { * |-folder2 (32) * |-fileA (42) * - * fileA is shared with user1 and user1@server1 + * fileA is shared with user1 and user1@server1 and email1@maildomain1 * folder2 is shared with group2 (user4 is a member of group2) * folder1 is shared with user2 (renamed to "folder (1)") and user2@server2 + * and email2@maildomain2 * * Then the access list to '/folder1/folder2/fileA' with $currentAccess is: * [ @@ -1594,7 +1615,10 @@ class Manager implements IManager { * 'user2@server2' => ['node_id' => 23, 'token' => 'FooBaR'], * ], * public => bool - * mail => bool + * mail => [ + * 'email1@maildomain1' => ['node_id' => 42, 'token' => 'aBcDeFg'], + * 'email2@maildomain2' => ['node_id' => 23, 'token' => 'hIjKlMn'], + * ] * ] * * The access list to '/folder1/folder2/fileA' **without** $currentAccess is: @@ -1602,7 +1626,7 @@ class Manager implements IManager { * users => ['user1', 'user2', 'user4'], * remote => bool, * public => bool - * mail => bool + * mail => ['email1@maildomain1', 'email2@maildomain2'] * ] * * This is required for encryption/activity @@ -1622,20 +1646,19 @@ class Manager implements IManager { $owner = $owner->getUID(); if ($currentAccess) { - $al = ['users' => [], 'remote' => [], 'public' => false]; + $al = ['users' => [], 'remote' => [], 'public' => false, 'mail' => []]; } else { - $al = ['users' => [], 'remote' => false, 'public' => false]; + $al = ['users' => [], 'remote' => false, 'public' => false, 'mail' => []]; } if (!$this->userManager->userExists($owner)) { return $al; } - //Get node for the owner and correct the owner in case of external storages + //Get node for the owner and correct the owner in case of external storage $userFolder = $this->rootFolder->getUserFolder($owner); if ($path->getId() !== $userFolder->getId() && !$userFolder->isSubNode($path)) { - $nodes = $userFolder->getById($path->getId()); - $path = array_shift($nodes); - if ($path->getOwner() === null) { + $path = $userFolder->getFirstNodeById($path->getId()); + if ($path === null || $path->getOwner() === null) { return []; } $owner = $path->getOwner()->getUID(); @@ -1721,16 +1744,41 @@ class Manager implements IManager { * @return bool */ public function shareApiAllowLinks() { - return $this->config->getAppValue('core', 'shareapi_allow_links', 'yes') === 'yes'; + if ($this->config->getAppValue('core', 'shareapi_allow_links', 'yes') !== 'yes') { + return false; + } + + $user = $this->userSession->getUser(); + if ($user) { + $excludedGroups = json_decode($this->config->getAppValue('core', 'shareapi_allow_links_exclude_groups', '[]')); + if ($excludedGroups) { + $userGroups = $this->groupManager->getUserGroupIds($user); + return !(bool)array_intersect($excludedGroups, $userGroups); + } + } + + return true; } /** * Is password on public link requires * + * @param bool Check group membership exclusion * @return bool */ - public function shareApiLinkEnforcePassword() { - return $this->config->getAppValue('core', 'shareapi_enforce_links_password', 'no') === 'yes'; + public function shareApiLinkEnforcePassword(bool $checkGroupMembership = true) { + $excludedGroups = $this->config->getAppValue('core', 'shareapi_enforce_links_password_excluded_groups', ''); + if ($excludedGroups !== '' && $checkGroupMembership) { + $excludedGroups = json_decode($excludedGroups); + $user = $this->userSession->getUser(); + if ($user) { + $userGroups = $this->groupManager->getUserGroupIds($user); + if ((bool)array_intersect($excludedGroups, $userGroups)) { + return false; + } + } + } + return $this->appConfig->getValueBool('core', ConfigLexicon::SHARE_LINK_PASSWORD_ENFORCED); } /** @@ -1745,16 +1793,18 @@ class Manager implements IManager { /** * Is default link expire date enforced *` + * * @return bool */ public function shareApiLinkDefaultExpireDateEnforced() { - return $this->shareApiLinkDefaultExpireDate() && - $this->config->getAppValue('core', 'shareapi_enforce_expire_date', 'no') === 'yes'; + return $this->shareApiLinkDefaultExpireDate() + && $this->config->getAppValue('core', 'shareapi_enforce_expire_date', 'no') === 'yes'; } /** * Number of default link expire days + * * @return int */ public function shareApiLinkDefaultExpireDays() { @@ -1771,18 +1821,37 @@ class Manager implements IManager { } /** + * Is default remote expire date enabled + * + * @return bool + */ + public function shareApiRemoteDefaultExpireDate(): bool { + return $this->config->getAppValue('core', 'shareapi_default_remote_expire_date', 'no') === 'yes'; + } + + /** * Is default expire date enforced - *` + * * @return bool */ public function shareApiInternalDefaultExpireDateEnforced(): bool { - return $this->shareApiInternalDefaultExpireDate() && - $this->config->getAppValue('core', 'shareapi_enforce_internal_expire_date', 'no') === 'yes'; + return $this->shareApiInternalDefaultExpireDate() + && $this->config->getAppValue('core', 'shareapi_enforce_internal_expire_date', 'no') === 'yes'; } + /** + * Is default expire date enforced for remote shares + * + * @return bool + */ + public function shareApiRemoteDefaultExpireDateEnforced(): bool { + return $this->shareApiRemoteDefaultExpireDate() + && $this->config->getAppValue('core', 'shareapi_enforce_remote_expire_date', 'no') === 'yes'; + } /** * Number of default expire days + * * @return int */ public function shareApiInternalDefaultExpireDays(): int { @@ -1790,6 +1859,15 @@ class Manager implements IManager { } /** + * Number of default expire days for remote shares + * + * @return int + */ + public function shareApiRemoteDefaultExpireDays(): int { + return (int)$this->config->getAppValue('core', 'shareapi_remote_expire_after_n_days', '7'); + } + + /** * Allow public upload on link shares * * @return bool @@ -1800,6 +1878,7 @@ class Manager implements IManager { /** * check if user can only share with group members + * * @return bool */ public function shareWithGroupMembersOnly() { @@ -1807,7 +1886,23 @@ class Manager implements IManager { } /** + * If shareWithGroupMembersOnly is enabled, return an optional + * list of groups that must be excluded from the principle of + * belonging to the same group. + * + * @return array + */ + public function shareWithGroupMembersOnlyExcludeGroupsList() { + if (!$this->shareWithGroupMembersOnly()) { + return []; + } + $excludeGroups = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members_exclude_group_list', ''); + return json_decode($excludeGroups, true) ?? []; + } + + /** * Check if users can share with groups + * * @return bool */ public function allowGroupSharing() { @@ -1819,53 +1914,79 @@ class Manager implements IManager { } public function limitEnumerationToGroups(): bool { - return $this->allowEnumeration() && - $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_group', 'no') === 'yes'; + return $this->allowEnumeration() + && $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_group', 'no') === 'yes'; } - /** - * Copied from \OC_Util::isSharingDisabledForUser - * - * TODO: Deprecate fuction from OC_Util - * - * @param string $userId - * @return bool - */ - public function sharingDisabledForUser($userId) { - if ($userId === null) { + public function limitEnumerationToPhone(): bool { + return $this->allowEnumeration() + && $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_phone', 'no') === 'yes'; + } + + public function allowEnumerationFullMatch(): bool { + return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match', 'yes') === 'yes'; + } + + public function matchEmail(): bool { + return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_email', 'yes') === 'yes'; + } + + public function ignoreSecondDisplayName(): bool { + return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_dn', 'no') === 'yes'; + } + + public function allowCustomTokens(): bool { + return $this->appConfig->getValueBool('core', ConfigLexicon::SHARE_CUSTOM_TOKEN); + } + + public function allowViewWithoutDownload(): bool { + return $this->appConfig->getValueBool('core', 'shareapi_allow_view_without_download', true); + } + + public function currentUserCanEnumerateTargetUser(?IUser $currentUser, IUser $targetUser): bool { + if ($this->allowEnumerationFullMatch()) { + return true; + } + + if (!$this->allowEnumeration()) { return false; } - if (isset($this->sharingDisabledForUsersCache[$userId])) { - return $this->sharingDisabledForUsersCache[$userId]; + if (!$this->limitEnumerationToPhone() && !$this->limitEnumerationToGroups()) { + // Enumeration is enabled and not restricted: OK + return true; } - if ($this->config->getAppValue('core', 'shareapi_exclude_groups', 'no') === 'yes') { - $groupsList = $this->config->getAppValue('core', 'shareapi_exclude_groups_list', ''); - $excludedGroups = json_decode($groupsList); - if (is_null($excludedGroups)) { - $excludedGroups = explode(',', $groupsList); - $newValue = json_encode($excludedGroups); - $this->config->setAppValue('core', 'shareapi_exclude_groups_list', $newValue); - } - $user = $this->userManager->get($userId); - $usersGroups = $this->groupManager->getUserGroupIds($user); - if (!empty($usersGroups)) { - $remainingGroups = array_diff($usersGroups, $excludedGroups); - // if the user is only in groups which are disabled for sharing then - // sharing is also disabled for the user - if (empty($remainingGroups)) { - $this->sharingDisabledForUsersCache[$userId] = true; - return true; - } + if (!$currentUser instanceof IUser) { + // Enumeration restrictions require an account + return false; + } + + // Enumeration is limited to phone match + if ($this->limitEnumerationToPhone() && $this->knownUserService->isKnownToUser($currentUser->getUID(), $targetUser->getUID())) { + return true; + } + + // Enumeration is limited to groups + if ($this->limitEnumerationToGroups()) { + $currentUserGroupIds = $this->groupManager->getUserGroupIds($currentUser); + $targetUserGroupIds = $this->groupManager->getUserGroupIds($targetUser); + if (!empty(array_intersect($currentUserGroupIds, $targetUserGroupIds))) { + return true; } } - $this->sharingDisabledForUsersCache[$userId] = false; return false; } /** + * Check if sharing is disabled for the current user + */ + public function sharingDisabledForUser(?string $userId): bool { + return $this->shareDisableChecker->sharingDisabledForUser($userId); + } + + /** * @inheritdoc */ public function outgoingServer2ServerSharesAllowed() { @@ -1903,4 +2024,43 @@ class Manager implements IManager { yield from $provider->getAllShares(); } } + + public function generateToken(): string { + // Initial token length + $tokenLength = \OC\Share\Helper::getTokenLength(); + + do { + $tokenExists = false; + + for ($i = 0; $i <= 2; $i++) { + // Generate a new token + $token = $this->secureRandom->generate( + $tokenLength, + ISecureRandom::CHAR_HUMAN_READABLE, + ); + + try { + // Try to fetch a share with the generated token + $this->getShareByToken($token); + $tokenExists = true; // Token exists, we need to try again + } catch (ShareNotFound $e) { + // Token is unique, exit the loop + $tokenExists = false; + break; + } + } + + // If we've reached the maximum attempts and the token still exists, increase the token length + if ($tokenExists) { + $tokenLength++; + + // Check if the token length exceeds the maximum allowed length + if ($tokenLength > \OC\Share\Constants::MAX_TOKEN_LENGTH) { + throw new ShareTokenException('Unable to generate a unique share token. Maximum token length exceeded.'); + } + } + } while ($tokenExists); + + return $token; + } } |