Backport of https://github.com/owncloud/core/pull/5193/

write the part file to the users root folder if the updated file is located in /Shared because we can't create new files in Shared/

2 files changed, 18 insertions, 4 deletions

diff --git a/lib/connector/sabre/directory.php b/lib/connector/sabre/directory.php
index 543bf376d26..96b9cd06d5b 100644
--- a/lib/connector/sabre/directory.php
+++ b/lib/connector/sabre/directory.php
@@ -50,15 +50,17 @@ class OC_Connector_Sabre_Directory extends OC_Connector_Sabre_Node implements Sa
 	 */
 	public function createFile($name, $data = null) {
 
-		if (!\OC\Files\Filesystem::isCreatable($this->path)) {
-			throw new \Sabre_DAV_Exception_Forbidden();
-		}
-
 		if (isset($_SERVER['HTTP_OC_CHUNKED'])) {
 			$info = OC_FileChunking::decodeName($name);
 			if (empty($info)) {
 				throw new Sabre_DAV_Exception_NotImplemented();
 			}
+
+			if (!\OC\Files\Filesystem::isCreatable($this->path) &&
+					!\OC\Files\Filesystem::isUpdatable($this->path . '/' . $info['name'])) {
+				throw new \Sabre_DAV_Exception_Forbidden();
+			}
+
 			$chunk_handler = new OC_FileChunking($info);
 			$chunk_handler->store($info['index'], $data);
 			if ($chunk_handler->isComplete()) {
@@ -67,6 +69,11 @@ class OC_Connector_Sabre_Directory extends OC_Connector_Sabre_Node implements Sa
 				return OC_Connector_Sabre_Node::getETagPropertyForPath($newPath);
 			}
 		} else {
+
+			if (!\OC\Files\Filesystem::isCreatable($this->path)) {
+				throw new \Sabre_DAV_Exception_Forbidden();
+			}
+
 			$newPath = $this->path . '/' . $name;
 
 			// mark file as partial while uploading (ignored by the scanner)
diff --git a/lib/connector/sabre/file.php b/lib/connector/sabre/file.php
index 2ddf833f40e..612a36514de 100644
--- a/lib/connector/sabre/file.php
+++ b/lib/connector/sabre/file.php
@@ -53,6 +53,13 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D
 		// mark file as partial while uploading (ignored by the scanner)
 		$partpath = $this->path . '.part';
 
+		// if file is located in /Shared we write the part file to the users
+		// root folder because we can't create new files in /shared
+		// we extend the name with a random number to avoid overwriting a existing file
+		if (dirname($partpath) === 'Shared') {
+			$partpath = pathinfo($partpath, PATHINFO_FILENAME) . rand() . '.part';
+		}
+
 		\OC\Files\Filesystem::file_put_contents($partpath, $data);
 
 		//detect aborted upload