Skip to content

Commit

Permalink
Check permissions of all accessible file for versions
Browse files Browse the repository at this point in the history
Signed-off-by: Louis Chemineau <[email protected]>
  • Loading branch information
artonge committed Mar 20, 2024
1 parent c451829 commit 9628bb1
Showing 1 changed file with 10 additions and 6 deletions.
16 changes: 10 additions & 6 deletions apps/files_versions/lib/Versions/LegacyVersionsBackend.php
Original file line number Diff line number Diff line change
Expand Up @@ -275,15 +275,19 @@ private function currentUserHasPermissions(FileInfo $sourceFile, int $permission
throw new NotFoundException("No user logged in");
}

if ($sourceFile->getOwner()?->getUID() !== $currentUserId) {
$nodes = $this->rootFolder->getUserFolder($currentUserId)->getById($sourceFile->getId());
$sourceFile = array_pop($nodes);
if (!$sourceFile) {
throw new NotFoundException("Version file not accessible by current user");
$nodes = $this->rootFolder->getUserFolder($currentUserId)->getById($sourceFile->getId());

if (count($nodes) === 0) {
throw new NotFoundException("Version file not accessible by current user");
}

foreach ($nodes as $node) {
if (($node->getPermissions() & $permissions) === $permissions) {
return true;
}
}

return ($sourceFile->getPermissions() & $permissions) === $permissions;
return false;
}

public function setMetadataValue(Node $node, int $revision, string $key, string $value): void {
Expand Down

0 comments on commit 9628bb1

Please sign in to comment.