Correctly check if the share has a password and if it was entered correctly.

This prevents joining the room for a file shared by link and protected
by password if the password has not been entered yet.

Signed-off-by: Joas Schilling <coding@schilljs.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/lib/Controller/PublicShareController.php b/lib/Controller/PublicShareController.php
index 54b8e8acd..ab7f6f395 100644
--- a/lib/Controller/PublicShareController.php
+++ b/lib/Controller/PublicShareController.php
@@ -33,6 +33,7 @@ use OCP\AppFramework\OCSController;
 use OCP\Files\FileInfo;
 use OCP\Files\NotFoundException;
 use OCP\IRequest;
+use OCP\ISession;
 use OCP\Share\Exceptions\ShareNotFound;
 use OCP\Share\IManager as ShareManager;
 use OCP\Share\IShare;
@@ -41,6 +42,8 @@ class PublicShareController extends OCSController {
 
 	/** @var ShareManager */
 	private $shareManager;
+	/** @var ISession */
+	private $session;
 	/** @var TalkSession */
 	private $talkSession;
 	/** @var Manager */
@@ -50,11 +53,13 @@ class PublicShareController extends OCSController {
 			$appName,
 			IRequest $request,
 			ShareManager $shareManager,
+			ISession $session,
 			TalkSession $talkSession,
 			Manager $manager
 	) {
 		parent::__construct($appName, $request);
 		$this->shareManager = $shareManager;
+		$this->session = $session;
 		$this->talkSession = $talkSession;
 		$this->manager = $manager;
 	}
@@ -89,6 +94,12 @@ class PublicShareController extends OCSController {
 	public function getRoom(string $shareToken) {
 		try {
 			$share = $this->shareManager->getShareByToken($shareToken);
+			if ($share->getPassword() !== null) {
+				$shareId = $this->session->get('public_link_authenticated');
+				if ($share->getId() !== $shareId) {
+					throw new ShareNotFound();
+				}
+			}
 		} catch (ShareNotFound $e) {
 			return new DataResponse([], Http::STATUS_NOT_FOUND);
 		}