summaryrefslogtreecommitdiffstats
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/public/share.php45
1 files changed, 41 insertions, 4 deletions
diff --git a/lib/public/share.php b/lib/public/share.php
index eb1dd8d1c95..f832d04a70f 100644
--- a/lib/public/share.php
+++ b/lib/public/share.php
@@ -347,20 +347,29 @@ class Share {
}
/**
- * Get the item shared by a token
- * @param string token
- * @return Item
+ * Based on the given token the share information will be returned - password protected shares will be verified
+ * @param string $token
+ * @return array | bool false will be returned in case the token is unknown or unauthorized
*/
- public static function getShareByToken($token) {
+ public static function getShareByToken($token, $checkPasswordProtection = true) {
$query = \OC_DB::prepare('SELECT * FROM `*PREFIX*share` WHERE `token` = ?', 1);
$result = $query->execute(array($token));
if (\OC_DB::isError($result)) {
\OC_Log::write('OCP\Share', \OC_DB::getErrorMessage($result) . ', token=' . $token, \OC_Log::ERROR);
}
$row = $result->fetchRow();
+ if ($row === false) {
+ return false;
+ }
if (is_array($row) and self::expireItem($row)) {
return false;
}
+
+ // password protected shares need to be authenticated
+ if ($checkPasswordProtection && !\OCP\Share::checkPasswordProtectedShare($row)) {
+ return false;
+ }
+
return $row;
}
@@ -1888,6 +1897,34 @@ class Share {
}
}
+ /**
+ * In case a password protected link is not yet authenticated this function will return false
+ *
+ * @param array $linkItem
+ * @return bool
+ */
+ public static function checkPasswordProtectedShare(array $linkItem) {
+ if (!isset($linkItem['share_with'])) {
+ return true;
+ }
+ if (!isset($linkItem['share_type'])) {
+ return true;
+ }
+ if (!isset($linkItem['id'])) {
+ return true;
+ }
+
+ if ($linkItem['share_type'] != \OCP\Share::SHARE_TYPE_LINK) {
+ return true;
+ }
+
+ if ( \OC::$session->exists('public_link_authenticated')
+ && \OC::$session->get('public_link_authenticated') === $linkItem['id'] ) {
+ return true;
+ }
+
+ return false;
+ }
}
/**