From 8629d8e44f31dbcc0d8237391aa2fbaeea2d13f1 Mon Sep 17 00:00:00 2001 From: Julius Härtl Date: Tue, 25 Oct 2022 09:15:39 +0200 Subject: Check share attributes on preview endpoints MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julius Härtl --- core/Controller/PreviewController.php | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'core/Controller/PreviewController.php') diff --git a/core/Controller/PreviewController.php b/core/Controller/PreviewController.php index 85dedd0bf68..9b3acaae013 100644 --- a/core/Controller/PreviewController.php +++ b/core/Controller/PreviewController.php @@ -27,6 +27,7 @@ declare(strict_types=1); */ namespace OC\Core\Controller; +use OCA\Files_Sharing\SharedStorage; use OCP\AppFramework\Controller; use OCP\AppFramework\Http; use OCP\AppFramework\Http\DataResponse; @@ -129,6 +130,16 @@ class PreviewController extends Controller { return new DataResponse([], Http::STATUS_FORBIDDEN); } + $storage = $node->getStorage(); + if ($storage->instanceOfStorage(SharedStorage::class)) { + /** @var SharedStorage $storage */ + $share = $storage->getShare(); + $attributes = $share->getAttributes(); + if ($attributes !== null && $attributes->getAttribute('permissions', 'download') === false) { + return new DataResponse([], Http::STATUS_FORBIDDEN); + } + } + try { $f = $this->preview->getPreview($node, $x, $y, !$a, $mode); $response = new FileDisplayResponse($f, Http::STATUS_OK, [ -- cgit v1.2.3