Merge pull request #1742 from nextcloud/backport/1739/stable20

[stable20] Don't allow to permanantly delete files if the user can't delete files

1 files changed, 5 insertions, 1 deletions

diff --git a/lib/Trash/TrashBackend.php b/lib/Trash/TrashBackend.php
index 257c46ac..668c1317 100644
--- a/lib/Trash/TrashBackend.php
+++ b/lib/Trash/TrashBackend.php
@@ -154,7 +154,7 @@ class TrashBackend implements ITrashBackend {
 
 	public function removeItem(ITrashItem $item) {
 		$user = $item->getUser();
-		list(, $folderId) = explode('/', $item->getTrashPath());
+		[, $folderId] = explode('/', $item->getTrashPath());
 		$node = $this->getNodeForTrashItem($user, $item);
 		if ($node === null) {
 			throw new NotFoundException();
@@ -162,6 +162,10 @@ class TrashBackend implements ITrashBackend {
 		if ($node->getStorage()->unlink($node->getInternalPath()) === false) {
 			throw new \Exception('Failed to remove item from trashbin');
 		}
+		if (!$this->userHasAccessToPath($item->getUser(), $folderId . '/' . $item->getOriginalLocation(), Constants::PERMISSION_DELETE)) {
+			throw new NotPermittedException();
+		}
+
 		$node->getStorage()->getCache()->remove($node->getInternalPath());
 		if ($item->isRootItem()) {
 			$this->trashManager->removeItem($folderId, $item->getName(), $item->getDeletedTime());