wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #15772 from owncloud/issue-15771-dont-restrict-permissions-for-share-owner

Browse source 
Do not restrict permissions for the original owner
This commit is contained in:
Joas Schilling 2015-05-04 15:07:37 +02:00
commit 59c657da53
4 changed files with 68 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/js/share.js
View file

@ -356,7 +356,7 @@ OC.Share={
var data = OC.Share.loadItem(itemType, itemSource);
var dropDownEl;
var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="'+itemType+'" data-item-source="'+itemSource+'">';
if (data !== false && data.reshare !== false && data.reshare.uid_owner !== undefined) {
if (data !== false && data.reshare !== false && data.reshare.uid_owner !== undefined && data.reshare.uid_owner !== OC.currentUser) {
html += '<span class="reshare">';
if (oc_config.enable_avatars === true) {
html += '<div class="avatar"></div> ';

25
core/js/tests/specs/shareSpec.js
View file

@ -29,6 +29,7 @@ describe('OC.Share tests', function() {
var oldEnableAvatars;
var avatarStub;
var placeholderStub;
var oldCurrentUser;
beforeEach(function() {
$('#testArea').append($('<div id="shareContainer"></div>'));
@ -62,8 +63,12 @@ describe('OC.Share tests', function() {
oc_config.enable_avatars = false;
avatarStub = sinon.stub($.fn, 'avatar');
placeholderStub = sinon.stub($.fn, 'imageplaceholder');
oldCurrentUser = OC.currentUser;
OC.currentUser = 'user0';
});
afterEach(function() {
OC.currentUser = oldCurrentUser;
/* jshint camelcase:false */
oc_appconfig.core = oldAppConfig;
loadItemStub.restore();
@ -864,6 +869,26 @@ describe('OC.Share tests', function() {
);
expect($('#dropdown #shareWithList').length).toEqual(0);
});
it('allows owner to share their own share when they are also the recipient', function() {
OC.currentUser = 'user1';
loadItemStub.returns({
reshare: {
permissions: OC.PERMISSION_READ,
uid_owner: 'user1'
},
shares: []
});
OC.Share.showDropDown(
'file',
123,
$container,
true,
OC.PERMISSION_ALL,
'shared_file_name.txt'
);
// sharing still allowed
expect($('#dropdown #shareWithList').length).toEqual(1);
});
});
});
});

16
lib/private/share/share.php
View file

@ -333,15 +333,15 @@ class Share extends Constants {
$shares = array();
$fileDependent = false;
$where = 'WHERE';
$fileDependentWhere = '';
if ($itemType === 'file' || $itemType === 'folder') {
$fileDependent = true;
$column = 'file_source';
$where = 'INNER JOIN `*PREFIX*filecache` ON `file_source` = `*PREFIX*filecache`.`fileid` ';
$where .= 'INNER JOIN `*PREFIX*storages` ON `numeric_id` = `*PREFIX*filecache`.`storage` ';
$where .= ' WHERE';
$fileDependentWhere = 'INNER JOIN `*PREFIX*filecache` ON `file_source` = `*PREFIX*filecache`.`fileid` ';
$fileDependentWhere .= 'INNER JOIN `*PREFIX*storages` ON `numeric_id` = `*PREFIX*filecache`.`storage` ';
} else {
$column = 'item_source';
$where = 'WHERE';
}
$select = self::createSelectStatement(self::FORMAT_NONE, $fileDependent);
@ -364,7 +364,7 @@ class Share extends Constants {
$arguments[] = $owner;
}
$query = \OC_DB::prepare('SELECT ' . $select . ' FROM `*PREFIX*share` '. $where);
$query = \OC_DB::prepare('SELECT ' . $select . ' FROM `*PREFIX*share` '. $fileDependentWhere . $where);
$result = \OC_DB::executeAudited($query, $arguments);
@ -380,7 +380,7 @@ class Share extends Constants {
$groups = \OC_Group::getUserGroups($user);
if (!empty($groups)) {
$where = 'WHERE `' . $column . '` = ? AND `item_type` = ? AND `share_with` in (?)';
$where = $fileDependentWhere . ' WHERE `' . $column . '` = ? AND `item_type` = ? AND `share_with` in (?)';
$arguments = array($itemSource, $itemType, $groups);
$types = array(null, null, \Doctrine\DBAL\Connection::PARAM_STR_ARRAY);
@ -394,7 +394,7 @@ class Share extends Constants {
// class isn't static anymore...
$conn = \OC_DB::getConnection();
$result = $conn->executeQuery(
'SELECT * FROM `*PREFIX*share` ' . $where,
'SELECT ' . $select . ' FROM `*PREFIX*share` ' . $where,
$arguments,
$types
);
@ -2100,7 +2100,9 @@ class Share extends Constants {
\OC_Log::write('OCP\Share', sprintf($message, $itemSourceName, $shareWith), \OC_Log::ERROR);
throw new \Exception($message_t);
}
}
if ($checkReshare && $checkReshare['uid_owner'] !== \OC_User::getUser()) {
// Check if share permissions is granted
if (self::isResharingAllowed() && (int)$checkReshare['permissions'] & \OCP\Constants::PERMISSION_SHARE) {
if (~(int)$checkReshare['permissions'] & $permissions) {

33
tests/lib/share/share.php
View file

@ -501,6 +501,38 @@ class Test_Share extends \Test\TestCase {
}
public function testSharingAFolderThatIsSharedWithAGroupOfTheOwner() {
OC_User::setUserId($this->user1);
$view = new \OC\Files\View('/' . $this->user1 . '/');
$view->mkdir('files/test');
$view->mkdir('files/test/sub1');
$view->mkdir('files/test/sub1/sub2');
$fileInfo = $view->getFileInfo('files/test/sub1');
$fileId = $fileInfo->getId();
$this->assertTrue(
OCP\Share::shareItem('folder', $fileId, OCP\Share::SHARE_TYPE_GROUP, $this->group1, \OCP\Constants::PERMISSION_READ + \OCP\Constants::PERMISSION_CREATE),
'Failed asserting that user 1 successfully shared "test/sub1" with group 1.'
);
$result = OCP\Share::getItemShared('folder', $fileId, Test_Share_Backend::FORMAT_SOURCE);
$this->assertNotEmpty($result);
$this->assertEquals(\OCP\Constants::PERMISSION_READ + \OCP\Constants::PERMISSION_CREATE, $result['permissions']);
$fileInfo = $view->getFileInfo('files/test/sub1/sub2');
$fileId = $fileInfo->getId();
$this->assertTrue(
OCP\Share::shareItem('folder', $fileId, OCP\Share::SHARE_TYPE_USER, $this->user4, \OCP\Constants::PERMISSION_READ),
'Failed asserting that user 1 successfully shared "test/sub1/sub2" with user 4.'
);
$result = OCP\Share::getItemShared('folder', $fileId, Test_Share_Backend::FORMAT_SOURCE);
$this->assertNotEmpty($result);
$this->assertEquals(\OCP\Constants::PERMISSION_READ, $result['permissions']);
}
protected function shareUserOneTestFileWithGroupOne() {
OC_User::setUserId($this->user1);
$this->assertTrue(
@ -766,6 +798,7 @@ class Test_Share extends \Test\TestCase {
/**
* @param boolean|string $token
* @return array
*/
protected function getShareByValidToken($token) {
$row = OCP\Share::getShareByToken($token);