From 9dfcb55a2f40226bfefee4fc30781f41790dcee2 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Thu, 17 Mar 2016 11:35:31 +0100 Subject: [PATCH] Set proper public webdav permissions when public upload disabled Fixes #23325 It can happen that a user shares a folder with public upload. And some time later the admin disables public upload on the server. To make sure this is handled correctly we need to check the config value and reduce the permissions. Fix is kept small to be easy backportable. --- apps/dav/lib/connector/publicauth.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/dav/lib/connector/publicauth.php b/apps/dav/lib/connector/publicauth.php index 3d800e88004..f069a214fe8 100644 --- a/apps/dav/lib/connector/publicauth.php +++ b/apps/dav/lib/connector/publicauth.php @@ -61,6 +61,11 @@ class PublicAuth extends \Sabre\DAV\Auth\Backend\AbstractBasic { return false; } + if ((int)$linkItem['share_type'] === \OCP\Share::SHARE_TYPE_LINK && + $this->config->getAppValue('core', 'shareapi_allow_public_upload', 'yes') !== 'yes') { + $this->share['permissions'] &= ~(\OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE); + } + // check if the share is password protected if (isset($linkItem['share_with'])) { if ($linkItem['share_type'] == \OCP\Share::SHARE_TYPE_LINK) {