Skip to content

Commit 7bc3c2e

Browse files
MorrisJobkeMorrisJobke
authored
Merge pull request #7363 from nextcloud/default-share-perms
Let the admin configure the default share permissions
2 parents 01f420c + 20ec034 commit 7bc3c2e

17 files changed

Lines changed: 244 additions & 64 deletions

File tree

‎apps/files_sharing/lib/Capabilities.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
namespace OCA\Files_Sharing;
2424

2525
use OCP\Capabilities\ICapability;
26+
use OCP\Constants;
2627
use \OCP\IConfig;
2728

2829
/**
@@ -86,6 +87,7 @@ public function getCapabilities() {
8687
$res['group'] = [];
8788
$res['group']['enabled'] = $this->config->getAppValue('core', 'shareapi_allow_group_sharing', 'yes') === 'yes';
8889
$res['group']['expire_date']['enabled'] = true;
90+
$res['default_permissions'] = (int)$this->config->getAppValue('core', 'shareapi_default_permissions', Constants::PERMISSION_ALL);
8991
}
9092

9193
//Federated sharing

‎apps/files_sharing/lib/Controller/ShareAPIController.php‎

Lines changed: 35 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,10 @@
3535
use OCP\AppFramework\OCS\OCSForbiddenException;
3636
use OCP\AppFramework\OCS\OCSNotFoundException;
3737
use OCP\AppFramework\OCSController;
38+
use OCP\Constants;
3839
use OCP\Files\Node;
3940
use OCP\Files\NotFoundException;
41+
use OCP\IConfig;
4042
use OCP\IGroupManager;
4143
use OCP\IL10N;
4244
use OCP\IUserManager;
@@ -75,6 +77,8 @@ class ShareAPIController extends OCSController {
7577
private $l;
7678
/** @var \OCP\Files\Node */
7779
private $lockedNode;
80+
/** @var IConfig */
81+
private $config;
7882

7983
/**
8084
* Share20OCS constructor.
@@ -88,6 +92,7 @@ class ShareAPIController extends OCSController {
8892
* @param IURLGenerator $urlGenerator
8993
* @param string $userId
9094
* @param IL10N $l10n
95+
* @param IConfig $config
9196
*/
9297
public function __construct(
9398
$appName,
@@ -98,7 +103,8 @@ public function __construct(
98103
IRootFolder $rootFolder,
99104
IURLGenerator $urlGenerator,
100105
$userId,
101-
IL10N $l10n
106+
IL10N $l10n,
107+
IConfig $config
102108
) {
103109
parent::__construct($appName, $request);
104110

@@ -110,6 +116,7 @@ public function __construct(
110116
$this->urlGenerator = $urlGenerator;
111117
$this->currentUser = $userId;
112118
$this->l = $l10n;
119+
$this->config = $config;
113120
}
114121

115122
/**
@@ -318,7 +325,7 @@ public function deleteShare($id) {
318325
*/
319326
public function createShare(
320327
$path = null,
321-
$permissions = \OCP\Constants::PERMISSION_ALL,
328+
$permissions = null,
322329
$shareType = -1,
323330
$shareWith = null,
324331
$publicUpload = 'false',
@@ -327,6 +334,10 @@ public function createShare(
327334
) {
328335
$share = $this->shareManager->newShare();
329336

337+
if ($permissions === null) {
338+
$permissions = $this->config->getAppValue('core', 'shareapi_default_permissions', Constants::PERMISSION_ALL);
339+
}
340+
330341
// Verify path
331342
if ($path === null) {
332343
throw new OCSNotFoundException($this->l->t('Please specify a file or folder path'));
@@ -347,17 +358,17 @@ public function createShare(
347358
throw new OCSNotFoundException($this->l->t('Could not create share'));
348359
}
349360

350-
if ($permissions < 0 || $permissions > \OCP\Constants::PERMISSION_ALL) {
361+
if ($permissions < 0 || $permissions > Constants::PERMISSION_ALL) {
351362
throw new OCSNotFoundException($this->l->t('invalid permissions'));
352363
}
353364

354365
// Shares always require read permissions
355-
$permissions |= \OCP\Constants::PERMISSION_READ;
366+
$permissions |= Constants::PERMISSION_READ;
356367

357368
if ($path instanceof \OCP\Files\File) {
358369
// Single file shares should never have delete or create permissions
359-
$permissions &= ~\OCP\Constants::PERMISSION_DELETE;
360-
$permissions &= ~\OCP\Constants::PERMISSION_CREATE;
370+
$permissions &= ~Constants::PERMISSION_DELETE;
371+
$permissions &= ~Constants::PERMISSION_CREATE;
361372
}
362373

363374
/*
@@ -414,13 +425,13 @@ public function createShare(
414425
}
415426

416427
$share->setPermissions(
417-
\OCP\Constants::PERMISSION_READ |
418-
\OCP\Constants::PERMISSION_CREATE |
419-
\OCP\Constants::PERMISSION_UPDATE |
420-
\OCP\Constants::PERMISSION_DELETE
428+
Constants::PERMISSION_READ |
429+
Constants::PERMISSION_CREATE |
430+
Constants::PERMISSION_UPDATE |
431+
Constants::PERMISSION_DELETE
421432
);
422433
} else {
423-
$share->setPermissions(\OCP\Constants::PERMISSION_READ);
434+
$share->setPermissions(Constants::PERMISSION_READ);
424435
}
425436

426437
// Set password
@@ -447,13 +458,9 @@ public function createShare(
447458
$share->setPermissions($permissions);
448459
} else if ($shareType === \OCP\Share::SHARE_TYPE_EMAIL) {
449460
if ($share->getNodeType() === 'file') {
450-
$share->setPermissions(\OCP\Constants::PERMISSION_READ);
461+
$share->setPermissions(Constants::PERMISSION_READ);
451462
} else {
452-
$share->setPermissions(
453-
\OCP\Constants::PERMISSION_READ |
454-
\OCP\Constants::PERMISSION_CREATE |
455-
\OCP\Constants::PERMISSION_UPDATE |
456-
\OCP\Constants::PERMISSION_DELETE);
463+
$share->setPermissions($permissions);
457464
}
458465
$share->setSharedWith($shareWith);
459466
} else if ($shareType === \OCP\Share::SHARE_TYPE_CIRCLE) {
@@ -698,33 +705,33 @@ public function updateShare(
698705

699706
$newPermissions = null;
700707
if ($publicUpload === 'true') {
701-
$newPermissions = \OCP\Constants::PERMISSION_READ | \OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_DELETE;
708+
$newPermissions = Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE | Constants::PERMISSION_DELETE;
702709
} else if ($publicUpload === 'false') {
703-
$newPermissions = \OCP\Constants::PERMISSION_READ;
710+
$newPermissions = Constants::PERMISSION_READ;
704711
}
705712

706713
if ($permissions !== null) {
707714
$newPermissions = (int)$permissions;
708-
$newPermissions = $newPermissions & ~\OCP\Constants::PERMISSION_SHARE;
715+
$newPermissions = $newPermissions & ~Constants::PERMISSION_SHARE;
709716
}
710717

711718
if ($newPermissions !== null &&
712719
!in_array($newPermissions, [
713-
\OCP\Constants::PERMISSION_READ,
714-
\OCP\Constants::PERMISSION_READ | \OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE, // legacy
715-
\OCP\Constants::PERMISSION_READ | \OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_DELETE, // correct
716-
\OCP\Constants::PERMISSION_CREATE, // hidden file list
717-
\OCP\Constants::PERMISSION_READ | \OCP\Constants::PERMISSION_UPDATE, // allow to edit single files
720+
Constants::PERMISSION_READ,
721+
Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE, // legacy
722+
Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE | Constants::PERMISSION_DELETE, // correct
723+
Constants::PERMISSION_CREATE, // hidden file list
724+
Constants::PERMISSION_READ | Constants::PERMISSION_UPDATE, // allow to edit single files
718725
])
719726
) {
720727
throw new OCSBadRequestException($this->l->t('Can\'t change permissions for public share links'));
721728
}
722729

723730
if (
724731
// legacy
725-
$newPermissions === (\OCP\Constants::PERMISSION_READ | \OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE) ||
732+
$newPermissions === (Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE) ||
726733
// correct
727-
$newPermissions === (\OCP\Constants::PERMISSION_READ | \OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_DELETE)
734+
$newPermissions === (Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE | Constants::PERMISSION_DELETE)
728735
) {
729736
if (!$this->shareManager->shareApiLinkAllowPublicUpload()) {
730737
throw new OCSForbiddenException($this->l->t('Public upload disabled by the administrator'));
@@ -735,7 +742,7 @@ public function updateShare(
735742
}
736743

737744
// normalize to correct public upload permissions
738-
$newPermissions = \OCP\Constants::PERMISSION_READ | \OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_DELETE;
745+
$newPermissions = Constants::PERMISSION_READ | Constants::PERMISSION_CREATE | Constants::PERMISSION_UPDATE | Constants::PERMISSION_DELETE;
739746
}
740747

741748
if ($newPermissions !== null) {

‎apps/files_sharing/tests/ApiTest.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
use OCP\AppFramework\OCS\OCSException;
3838
use OCP\AppFramework\OCS\OCSForbiddenException;
3939
use OCP\AppFramework\OCS\OCSNotFoundException;
40+
use OCP\IConfig;
4041
use OCP\IL10N;
4142
use OCP\IRequest;
4243

@@ -105,6 +106,7 @@ private function createOCS($userId) {
105106
->will($this->returnCallback(function($text, $parameters = []) {
106107
return vsprintf($text, $parameters);
107108
}));
109+
$config = $this->createMock(IConfig::class);
108110

109111
return new ShareAPIController(
110112
self::APP_NAME,
@@ -115,7 +117,8 @@ private function createOCS($userId) {
115117
\OC::$server->getRootFolder(),
116118
\OC::$server->getURLGenerator(),
117119
$userId,
118-
$l
120+
$l,
121+
$config
119122
);
120123
}
121124

‎apps/files_sharing/tests/Controller/ShareAPIControllerTest.php‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
use OCP\Files\File;
3232
use OCP\Files\Folder;
3333
use OCP\Files\Storage;
34+
use OCP\IConfig;
3435
use OCP\IL10N;
3536
use OCA\Files_Sharing\Controller\ShareAPIController;
3637
use OCP\Files\NotFoundException;
@@ -84,6 +85,9 @@ class ShareAPIControllerTest extends TestCase {
8485
/** @var IL10N|\PHPUnit_Framework_MockObject_MockObject */
8586
private $l;
8687

88+
/** @var IConfig|\PHPUnit_Framework_MockObject_MockObject */
89+
private $config;
90+
8791
protected function setUp() {
8892
$this->shareManager = $this->createMock(IManager::class);
8993
$this->shareManager
@@ -102,6 +106,7 @@ protected function setUp() {
102106
->will($this->returnCallback(function($text, $parameters = []) {
103107
return vsprintf($text, $parameters);
104108
}));
109+
$this->config = $this->createMock(IConfig::class);
105110

106111
$this->ocs = new ShareAPIController(
107112
$this->appName,
@@ -112,7 +117,8 @@ protected function setUp() {
112117
$this->rootFolder,
113118
$this->urlGenerator,
114119
$this->currentUser,
115-
$this->l
120+
$this->l,
121+
$this->config
116122
);
117123
}
118124

@@ -131,6 +137,7 @@ private function mockFormatShare() {
131137
$this->urlGenerator,
132138
$this->currentUser,
133139
$this->l,
140+
$this->config
134141
])->setMethods(['formatShare'])
135142
->getMock();
136143
}
@@ -439,6 +446,7 @@ public function testGetShare(\OCP\Share\IShare $share, array $result) {
439446
$this->urlGenerator,
440447
$this->currentUser,
441448
$this->l,
449+
$this->config
442450
])->setMethods(['canAccessShare'])
443451
->getMock();
444452

@@ -707,6 +715,7 @@ public function testCreateShareUser() {
707715
$this->urlGenerator,
708716
$this->currentUser,
709717
$this->l,
718+
$this->config
710719
])->setMethods(['formatShare'])
711720
->getMock();
712721

@@ -804,6 +813,7 @@ public function testCreateShareGroup() {
804813
$this->urlGenerator,
805814
$this->currentUser,
806815
$this->l,
816+
$this->config
807817
])->setMethods(['formatShare'])
808818
->getMock();
809819

@@ -1119,6 +1129,7 @@ public function testCreateReshareOfFederatedMountNoDeletePermissions() {
11191129
$this->urlGenerator,
11201130
$this->currentUser,
11211131
$this->l,
1132+
$this->config
11221133
])->setMethods(['formatShare'])
11231134
->getMock();
11241135

‎core/Controller/OCJSController.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
namespace OC\Core\Controller;
2727

2828
use bantu\IniGetWrapper\IniGetWrapper;
29+
use OC\CapabilitiesManager;
2930
use OC\Template\JSConfigHelper;
3031
use OCP\App\IAppManager;
3132
use OCP\AppFramework\Controller;
@@ -59,6 +60,7 @@ class OCJSController extends Controller {
5960
* @param IGroupManager $groupManager
6061
* @param IniGetWrapper $iniWrapper
6162
* @param IURLGenerator $urlGenerator
63+
* @param CapabilitiesManager $capabilitiesManager
6264
*/
6365
public function __construct($appName,
6466
IRequest $request,
@@ -70,7 +72,8 @@ public function __construct($appName,
7072
IConfig $config,
7173
IGroupManager $groupManager,
7274
IniGetWrapper $iniWrapper,
73-
IURLGenerator $urlGenerator) {
75+
IURLGenerator $urlGenerator,
76+
CapabilitiesManager $capabilitiesManager) {
7477
parent::__construct($appName, $request);
7578

7679
$this->helper = new JSConfigHelper(
@@ -82,7 +85,8 @@ public function __construct($appName,
8285
$config,
8386
$groupManager,
8487
$iniWrapper,
85-
$urlGenerator
88+
$urlGenerator,
89+
$capabilitiesManager
8690
);
8791
}
8892

‎core/js/js.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,13 @@ var OCP = {},
8080
*/
8181
webroot:oc_webroot,
8282

83+
/**
84+
* Capabilities
85+
*
86+
* @type array
87+
*/
88+
_capabilities: window.oc_capabilities || null,
89+
8390
appswebroots:(typeof oc_appswebroots !== 'undefined') ? oc_appswebroots:false,
8491
/**
8592
* Currently logged in user or null if none
@@ -308,6 +315,18 @@ var OCP = {},
308315
return OC.webroot;
309316
},
310317

318+
319+
/**
320+
* Returns the capabilities
321+
*
322+
* @return {array} capabilities
323+
*
324+
* @since 14.0
325+
*/
326+
getCapabilities: function() {
327+
return OC._capabilities;
328+
},
329+
311330
/**
312331
* Returns the currently logged in user or null if there is no logged in
313332
* user (public page mode)

‎core/js/shareitemmodel.js‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -158,23 +158,24 @@
158158
var shareType = attributes.shareType;
159159
attributes = _.extend({}, attributes);
160160

161-
// Default permissions are Edit (CRUD) and Share
162-
// Check if these permissions are possible
163-
var permissions = OC.PERMISSION_READ;
161+
// get default permissions
162+
var defaultPermissions = OC.getCapabilities()['files_sharing']['default_permissions'] || OC.PERMISSION_ALL;
163+
var possiblePermissions = OC.PERMISSION_READ;
164+
164165
if (this.updatePermissionPossible()) {
165-
permissions = permissions | OC.PERMISSION_UPDATE;
166+
possiblePermissions = possiblePermissions | OC.PERMISSION_UPDATE;
166167
}
167168
if (this.createPermissionPossible()) {
168-
permissions = permissions | OC.PERMISSION_CREATE;
169+
possiblePermissions = possiblePermissions | OC.PERMISSION_CREATE;
169170
}
170171
if (this.deletePermissionPossible()) {
171-
permissions = permissions | OC.PERMISSION_DELETE;
172+
possiblePermissions = possiblePermissions | OC.PERMISSION_DELETE;
172173
}
173174
if (this.configModel.get('isResharingAllowed') && (this.sharePermissionPossible())) {
174-
permissions = permissions | OC.PERMISSION_SHARE;
175+
possiblePermissions = possiblePermissions | OC.PERMISSION_SHARE;
175176
}
176177

177-
attributes.permissions = permissions;
178+
attributes.permissions = defaultPermissions & possiblePermissions;
178179
if (_.isUndefined(attributes.path)) {
179180
attributes.path = this.fileInfoModel.getFullPath();
180181
}

0 commit comments

Comments
 (0)