Skip to content

Commit 9628bb1

Browse files
committed
Check permissions of all accessible file for versions
Signed-off-by: Louis Chemineau <louis@chmn.me>
1 parent c451829 commit 9628bb1

1 file changed

Lines changed: 10 additions & 6 deletions

File tree

apps/files_versions/lib/Versions/LegacyVersionsBackend.php

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -275,15 +275,19 @@ private function currentUserHasPermissions(FileInfo $sourceFile, int $permission
275275
throw new NotFoundException("No user logged in");
276276
}
277277

278-
if ($sourceFile->getOwner()?->getUID() !== $currentUserId) {
279-
$nodes = $this->rootFolder->getUserFolder($currentUserId)->getById($sourceFile->getId());
280-
$sourceFile = array_pop($nodes);
281-
if (!$sourceFile) {
282-
throw new NotFoundException("Version file not accessible by current user");
278+
$nodes = $this->rootFolder->getUserFolder($currentUserId)->getById($sourceFile->getId());
279+
280+
if (count($nodes) === 0) {
281+
throw new NotFoundException("Version file not accessible by current user");
282+
}
283+
284+
foreach ($nodes as $node) {
285+
if (($node->getPermissions() & $permissions) === $permissions) {
286+
return true;
283287
}
284288
}
285289

286-
return ($sourceFile->getPermissions() & $permissions) === $permissions;
290+
return false;
287291
}
288292

289293
public function setMetadataValue(Node $node, int $revision, string $key, string $value): void {

0 commit comments

Comments
 (0)