From da435b1e67930e85fc30fd1b94c6214caa086f4f Mon Sep 17 00:00:00 2001 From: Louis Chemineau Date: Wed, 2 Feb 2022 16:10:52 +0100 Subject: Support CRUD share permissions Signed-off-by: Louis Chemineau --- .../lib/Controller/ShareAPIController.php | 27 ++++++++++++++-------- 1 file changed, 17 insertions(+), 10 deletions(-) (limited to 'apps/files_sharing/lib') diff --git a/apps/files_sharing/lib/Controller/ShareAPIController.php b/apps/files_sharing/lib/Controller/ShareAPIController.php index ff134f61e17..fef71a868d5 100644 --- a/apps/files_sharing/lib/Controller/ShareAPIController.php +++ b/apps/files_sharing/lib/Controller/ShareAPIController.php @@ -1003,6 +1003,13 @@ class ShareAPIController extends OCSController { return new DataResponse(array_values($shares)); } + /** + * Check whether a set of permissions contains the permissions to check. + */ + private function hasPermission(int $permissionsSet, int $permissionsToCheck): bool { + return ($permissionsSet & $permissionsToCheck) === $permissionsToCheck; + } + /** * @NoAdminRequired @@ -1104,16 +1111,16 @@ class ShareAPIController extends OCSController { $newPermissions = $newPermissions & ~Constants::PERMISSION_SHARE; } - if ($newPermissions !== null && - !in_array($newPermissions, [ - Constants::PERMISSION_READ, - Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE, // legacy - Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE | Constants::PERMISSION_DELETE, // correct - Constants::PERMISSION_CREATE, // hidden file list - Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE, // allow to edit single files - ], true) - ) { - throw new OCSBadRequestException($this->l->t('Cannot change permissions for public share links')); + if ($newPermissions !== null) { + if (!$this->hasPermission($newPermissions, Constants::PERMISSION_READ) && !$this->hasPermission($newPermissions, Constants::PERMISSION_CREATE)) { + throw new OCSBadRequestException($this->l->t('Share must at least have READ or CREATE permissions')); + } + + if (!$this->hasPermission($newPermissions, Constants::PERMISSION_READ) && ( + $this->hasPermission($newPermissions, Constants::PERMISSION_UPDATE) || $this->hasPermission($newPermissions, Constants::PERMISSION_DELETE) + )) { + throw new OCSBadRequestException($this->l->t('Share must have READ permission if UPDATE or DELETE permission is set.')); + } } if ( -- cgit v1.2.3