Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[For 10.4] On the public preview route the share password needs to be verified a… #36571

Merged
merged 2 commits into from
Dec 13, 2019
Merged

[For 10.4] On the public preview route the share password needs to be verified a… #36571

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1cd3125
On the public preview route the share password needs to be verified a…
DeepDiver1975 Dec 11, 2019
d47fa25
Add api acceptance tests for checking the preview of public link shar…
dpakach Dec 11, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions apps/files_sharing/ajax/publicpreview.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,14 @@
$shareManager = \OC::$server->getShareManager();
try {
$linkedItem = $shareManager->getShareByToken($token);
if ($linkedItem->getPassword() !== null) {
$session = \OC::$server->getSession();
if (! $session->exists('public_link_authenticated')
|| $session->get('public_link_authenticated') !== (string)$linkedItem->getId()) {
// sending back 404 in case access is not allowed - not 401 because this way we would expose existence of a share
throw new ShareNotFound();
micbar marked this conversation as resolved.
Show resolved Hide resolved
}
}
} catch (ShareNotFound $e) {
\OC_Response::setStatus(\OC_Response::STATUS_NOT_FOUND);
\OCP\Util::writeLog('core-preview', 'Passed token parameter is not valid', \OCP\Util::DEBUG);
Expand Down
5 changes: 5 additions & 0 deletions changelog/unreleased/36571
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Change: Protect public preview with password

The preview route for password protected shares was accessible without the password.

micbar marked this conversation as resolved.
Show resolved Hide resolved
https://github.com/owncloud/core/pull/36571
48 changes: 48 additions & 0 deletions tests/acceptance/features/apiShareOperations/accessToShare.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,3 +63,51 @@ Feature: sharing
| ocs_api_version | ocs_status_code |
| 1 | 100 |
| 2 | 200 |

@public_link_share-feature-required
Scenario: Access to the preview of password protected public link
Given the administrator has enabled DAV tech_preview
And user "user0" has uploaded file "filesForUpload/testavatar.jpg" to "testavatar.jpg"
And user "user0" has created a public link share with settings
| path | /testavatar.jpg |
| permissions | change |
| password | testpass1 |
When the public accesses the preview of file "testavatar.jpg" from the last shared public link using the sharing API
Then the HTTP status code should be "404"

@public_link_share-feature-required
Scenario: Access to the preview of public shared file without password
Given the administrator has enabled DAV tech_preview
And user "user0" has uploaded file "filesForUpload/testavatar.jpg" to "testavatar.jpg"
And user "user0" has created a public link share with settings
| path | /testavatar.jpg |
| permissions | change |
When the public accesses the preview of file "testavatar.jpg" from the last shared public link using the sharing API
Then the HTTP status code should be "200"

@public_link_share-feature-required
Scenario: Access to the preview of password protected public shared file inside a folder
Given the administrator has enabled DAV tech_preview
And user "user0" has uploaded file "filesForUpload/testavatar.jpg" to "FOLDER/testavatar.jpg"
And user "user0" has moved file "textfile0.txt" to "FOLDER/textfile0.txt"
And user "user0" has created a public link share with settings
| path | /FOLDER |
| permissions | change |
| password | testpass1 |
When the public accesses the preview of file "testavatar.jpg" from the last shared public link using the sharing API
Then the HTTP status code should be "404"
When the public accesses the preview of file "textfile0.txt" from the last shared public link using the sharing API
Then the HTTP status code should be "404"

@public_link_share-feature-required
Scenario: Access to the preview of public shared file inside a folder without password
Given the administrator has enabled DAV tech_preview
And user "user0" has uploaded file "filesForUpload/testavatar.jpg" to "FOLDER/testavatar.jpg"
And user "user0" has moved file "textfile0.txt" to "FOLDER/textfile0.txt"
And user "user0" has created a public link share with settings
| path | /FOLDER |
| permissions | change |
When the public accesses the preview of file "testavatar.jpg" from the last shared public link using the sharing API
Then the HTTP status code should be "200"
When the public accesses the preview of file "textfile0.txt" from the last shared public link using the sharing API
Then the HTTP status code should be "200"
29 changes: 29 additions & 0 deletions tests/acceptance/features/bootstrap/Sharing.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1958,6 +1958,35 @@ public function getLastShareToken() {
return $this->lastShareData->data->token;
}

/**
* Send request for preview of a file in a public link
*
* @param string $fileName
* @param string $token
*
* @return void
*/
public function getPublicPreviewOfFile($fileName, $token) {
$url = $this->getBaseUrl() .
"/index.php/apps/files_sharing/ajax/publicpreview.php" .
"?file=$fileName&t=$token";
$resp = HttpRequestHelper::get($url);
$this->setResponse($resp);
}

/**
* @When the public accesses the preview of file :path from the last shared public link using the sharing API
*
* @param string $path
*
* @return void
*/
public function thePublicAccessesThePreviewOfTheSharedFileUsingTheSharingApi($path) {
$shareData = $this->getLastShareData();
$token = (string)$shareData->data->token;
$this->getPublicPreviewOfFile($path, $token);
}

/**
* replace values from table
*
Expand Down