wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Shares should have a least read permission

Browse source 
* Throw 400 when a share is created or updated without read permissions
* Added unit tests
This commit is contained in:
Roeland Jago Douma 2015-02-27 13:15:56 +01:00
parent ff85d38c2a
commit 4436a9ce35
2 changed files with 79 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
apps/files_sharing/api/local.php
View file

@ -276,6 +276,10 @@ class Local {
return new \OC_OCS_Result(null, 400, "unknown share type");
}
if (($permissions & \OCP\Constants::PERMISSION_READ) === 0) {
return new \OC_OCS_Result(null, 400, 'invalid permissions');
}
try {
$token = \OCP\Share::shareItem(
$itemType,
@ -347,7 +351,6 @@ class Local {
}
return new \OC_OCS_Result(null, 400, "Wrong or no update parameter given");
}
/**
@ -376,6 +379,10 @@ class Local {
}
}
if (($permissions & \OCP\Constants::PERMISSION_READ) === 0) {
return new \OC_OCS_Result(null, 400, 'invalid permissions');
}
try {
$return = \OCP\Share::setPermissions(
$itemType,

71
apps/files_sharing/tests/api.php
View file

@ -119,6 +119,32 @@ class Test_Files_Sharing_Api extends TestCase {
\OCP\Share::unshare('folder', $fileinfo['fileid'], \OCP\Share::SHARE_TYPE_LINK, null);
}
/**
* @medium
*/
public function testCreateShareInvalidPermissions() {
// simulate a post request
$_POST['path'] = $this->filename;
$_POST['shareWith'] = \Test_Files_Sharing_Api::TEST_FILES_SHARING_API_USER2;
$_POST['shareType'] = \OCP\Share::SHARE_TYPE_USER;
$_POST['permissions'] = \OCP\Constants::PERMISSION_SHARE;
$result = \OCA\Files_Sharing\API\Local::createShare([]);
// share was successful?
$this->assertFalse($result->succeeded());
$this->assertEquals(400, $result->getStatusCode());
$shares = \OCP\Share::getItemShared('file', null);
$this->assertCount(0, $shares);
$fileinfo = $this->view->getFileInfo($this->filename);
\OCP\Share::unshare('file', $fileinfo['fileid'], \OCP\Share::SHARE_TYPE_USER,
\Test_Files_Sharing_Api::TEST_FILES_SHARING_API_USER2);
}
function testEnfoceLinkPassword() {
$appConfig = \OC::$server->getAppConfig();
@ -883,6 +909,51 @@ class Test_Files_Sharing_Api extends TestCase {
}
/**
* @medium
* @depends testCreateShare
*/
public function testUpdateShareInvalidPermissions() {
$fileInfo = $this->view->getFileInfo($this->filename);
$result = \OCP\Share::shareItem('file', $fileInfo['fileid'], \OCP\Share::SHARE_TYPE_USER,
\Test_Files_Sharing_Api::TEST_FILES_SHARING_API_USER2, \OCP\Constants::PERMISSION_ALL);
// share was successful?
$this->assertTrue($result);
$share = \OCP\Share::getItemShared('file', null);
$this->assertCount(1, $share);
$share = reset($share);
// check if share have expected permissions, single shared files never have
// delete permissions
$this->assertEquals(\OCP\Constants::PERMISSION_ALL & ~\OCP\Constants::PERMISSION_DELETE, $share['permissions']);
// update permissions
$params = [];
$params['id'] = $share['id'];
$params['_put'] = [];
$params['_put']['permissions'] = \OCP\Constants::PERMISSION_SHARE;
$result = \OCA\Files_Sharing\API\Local::updateShare($params);
//Updating should fail with 400
$this->assertFalse($result->succeeded());
$this->assertEquals(400, $result->getStatusCode());
$share = \OCP\Share::getItemShared('file', $share['file_source']);
$share = reset($share);
//Permissions should not have changed!
$this->assertEquals(\OCP\Constants::PERMISSION_ALL & ~\OCP\Constants::PERMISSION_DELETE, $share['permissions']);
\OCP\Share::unshare('file', $fileInfo['fileid'], \OCP\Share::SHARE_TYPE_USER,
\Test_Files_Sharing_Api::TEST_FILES_SHARING_API_USER2);
}
/**
* @medium
*/