From 95060170ab46ecf48257147b4ba745938e13cbd2 Mon Sep 17 00:00:00 2001 From: provokateurin Date: Tue, 6 May 2025 11:11:09 +0200 Subject: [PATCH] fix: Respect storage permissions in shares Signed-off-by: provokateurin --- lib/Service/AttachmentService.php | 5 +++-- lib/Service/DocumentService.php | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/Service/AttachmentService.php b/lib/Service/AttachmentService.php index 43cdc346d38..50a5437d268 100644 --- a/lib/Service/AttachmentService.php +++ b/lib/Service/AttachmentService.php @@ -412,8 +412,9 @@ private function hasUpdatePermissions(string $shareToken): bool { [IShare::TYPE_LINK, IShare::TYPE_EMAIL, IShare::TYPE_ROOM], true ) - && $share->getPermissions() & Constants::PERMISSION_UPDATE); - } catch (ShareNotFound $e) { + && $share->getPermissions() & Constants::PERMISSION_UPDATE + && $share->getNode()->getPermissions() & Constants::PERMISSION_UPDATE); + } catch (ShareNotFound|NotFoundException $e) { return false; } } diff --git a/lib/Service/DocumentService.php b/lib/Service/DocumentService.php index 32e37b97fdf..006545bdbbd 100644 --- a/lib/Service/DocumentService.php +++ b/lib/Service/DocumentService.php @@ -603,7 +603,7 @@ public function checkSharePermissions(string $shareToken, int $permission = Cons throw new NotFoundException(); } - if (($share->getPermissions() & $permission) === 0) { + if (($share->getPermissions() & $permission) === 0 || ($share->getNode()->getPermissions() & $permission) === 0) { throw new NotFoundException(); } }