upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-02-11 14:54:02 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Merge pull request #29367 from nextcloud/backport/29362/stable21

Browse source 
[stable21] Fix security issues when copying groupfolder with advanced ACL
This commit is contained in:
Vincent Petry 2021-10-22 09:56:21 +02:00 committed by GitHub
commit a080c08d64
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/private/Files/Storage/Local.php
View file

@ -525,7 +525,10 @@ class Local extends \OC\Files\Storage\Common {
* @return bool
*/
public function copyFromStorage(IStorage $sourceStorage, $sourceInternalPath, $targetInternalPath, $preserveMtime = false) {
if ($sourceStorage->instanceOfStorage(Local::class)) {
// Don't treat ACLStorageWrapper like local storage where copy can be done directly.
// Instead use the slower recursive copying in php from Common::copyFromStorage with
// more permissions checks.
if ($sourceStorage->instanceOfStorage(Local::class) && !$sourceStorage->instanceOfStorage('OCA\GroupFolders\ACL\ACLStorageWrapper')) {
if ($sourceStorage->instanceOfStorage(Jail::class)) {
/**
* @var \OC\Files\Storage\Wrapper\Jail $sourceStorage