e2453d78c0
Despite it's PHPDoc the function might return `null` which was not properly catched and thus in some situations the share was resolved to the sharing users root directory. To test this perform the following steps: * Share file in owncloud 7 (7.0.4.2) * Delete the parent folder of the shared file * The share stays is in the DB and the share via the sharelink is inaccessible. (which is good) * Upgrade to owncloud 8 (8.0.2) (This step is crucial. The bug is not reproduceable without upgrading from 7 to 8. It seems like the old tokens are handled different than the newer ones) * Optional Step: Logout, Reset Browser Session, etc. * Access the share via the old share url: almost empty page, but there is a dowload button which adds a "/download" to the URL. * Upon clicking, a download.zip is downloaded which contains EVERYTHING from the owncloud directory (of the user who shared the file) * No exception is thrown and no error is logged. This will add a check whether the share is a valid one and also adds unit tests to prevent further regressions in the future. Needs to be backported to ownCloud 8. Adding a proper clean-up of the orphaned shares is out-of-scope and would probably require some kind of FK or so. Fixes https://github.com/owncloud/core/issues/15097
85 lines
2 KiB
PHP
85 lines
2 KiB
PHP
<?php
|
|
/**
|
|
* @author Lukas Reschke
|
|
* @copyright 2014 Lukas Reschke lukas@owncloud.com
|
|
*
|
|
* This file is licensed under the Affero General Public License version 3 or
|
|
* later.
|
|
* See the COPYING-README file.
|
|
*/
|
|
|
|
namespace OCA\Files_Sharing\Middleware;
|
|
|
|
use OCP\App\IAppManager;
|
|
use OCP\AppFramework\Http\NotFoundResponse;
|
|
use OCP\AppFramework\Middleware;
|
|
use OCP\AppFramework\Http\TemplateResponse;
|
|
use OCP\IConfig;
|
|
|
|
/**
|
|
* Checks whether the "sharing check" is enabled
|
|
*
|
|
* @package OCA\Files_Sharing\Middleware
|
|
*/
|
|
class SharingCheckMiddleware extends Middleware {
|
|
|
|
/** @var string */
|
|
protected $appName;
|
|
/** @var IConfig */
|
|
protected $config;
|
|
/** @var IAppManager */
|
|
protected $appManager;
|
|
|
|
/***
|
|
* @param string $appName
|
|
* @param IConfig $config
|
|
* @param IAppManager $appManager
|
|
*/
|
|
public function __construct($appName,
|
|
IConfig $config,
|
|
IAppManager $appManager) {
|
|
$this->appName = $appName;
|
|
$this->config = $config;
|
|
$this->appManager = $appManager;
|
|
}
|
|
|
|
/**
|
|
* Check if sharing is enabled before the controllers is executed
|
|
*/
|
|
public function beforeController($controller, $methodName) {
|
|
if(!$this->isSharingEnabled()) {
|
|
throw new \Exception('Sharing is disabled.');
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Return 404 page in case of an exception
|
|
* @param \OCP\AppFramework\Controller $controller
|
|
* @param string $methodName
|
|
* @param \Exception $exception
|
|
* @return TemplateResponse
|
|
*/
|
|
public function afterException($controller, $methodName, \Exception $exception){
|
|
return new NotFoundResponse();
|
|
}
|
|
|
|
/**
|
|
* Check whether sharing is enabled
|
|
* @return bool
|
|
*/
|
|
private function isSharingEnabled() {
|
|
// FIXME: This check is done here since the route is globally defined and not inside the files_sharing app
|
|
// Check whether the sharing application is enabled
|
|
if(!$this->appManager->isEnabledForUser($this->appName)) {
|
|
return false;
|
|
}
|
|
|
|
// Check whether public sharing is enabled
|
|
if($this->config->getAppValue('core', 'shareapi_allow_links', 'yes') !== 'yes') {
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
}
|