wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #19764 from nextcloud/fix/transfer-ownerhip-owner-check

Browse source 
Do not allow transfer ownership when the user isn't the owner
This commit is contained in:
Roeland Jago Douma 2020-03-03 20:20:43 +01:00 committed by GitHub
commit 65b75c8bba
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

BIN
apps/files/js/dist/personal-settings.js vendored
View file

Binary file not shown.

BIN
apps/files/js/dist/personal-settings.js.map vendored
View file

Binary file not shown.

4
apps/files/lib/Controller/TransferOwnershipController.php
View file

@ -96,6 +96,10 @@ class TransferOwnershipController extends OCSController {
return new DataResponse([], Http::STATUS_BAD_REQUEST); return new DataResponse([], Http::STATUS_BAD_REQUEST);
} }
if ($node->getOwner()->getUID() !== $this->userId) {
return new DataResponse([], Http::STATUS_FORBIDDEN);
}
$transferOwnership = new TransferOwnershipEntity(); $transferOwnership = new TransferOwnershipEntity();
$transferOwnership->setSourceUser($this->userId); $transferOwnership->setSourceUser($this->userId);
$transferOwnership->setTargetUser($recipient); $transferOwnership->setTargetUser($recipient);

6
apps/files/src/components/TransferOwnershipDialogue.vue
View file

@ -215,7 +215,11 @@ export default {
.catch(error => { .catch(error => {
logger.error('Could not send ownership transfer request', { error }) logger.error('Could not send ownership transfer request', { error })
this.submitError = error.message || t('files', 'Unknown error') if (error?.response?.status === 403) {
this.submitError = t('files', 'Cannot transfter ownership of a file or folder you don\'t own')
} else {
this.submitError = error.message || t('files', 'Unknown error')
}
}) })
}, },
}, },