Don't load shares of files dropv17.0.1rc1

Signed-off-by: Joas Schilling <coding@schilljs.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/lib/Middleware/EnvCheckMiddleware.php b/lib/Middleware/EnvCheckMiddleware.php
index 43b57845..2e2ee835 100644
--- a/lib/Middleware/EnvCheckMiddleware.php
+++ b/lib/Middleware/EnvCheckMiddleware.php
@@ -16,6 +16,7 @@
 
 namespace OCA\Gallery\Middleware;
 
+use OCP\Constants;
 use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\ISession;
@@ -130,6 +131,13 @@ class EnvCheckMiddleware extends CheckMiddleware {
 			);
 		} else {
 			$share = $this->getShare($token);
+
+			if (($share->getPermissions() & Constants::PERMISSION_READ) === 0) {
+				throw new CheckException(
+					"Can't access a public resource that is upload only", Http::STATUS_NOT_FOUND
+				);
+			}
+
 			$password = $this->request->getParam('password');
 			// Let's see if the user needs to provide a password
 			$this->checkAuthorisation($share, $password);