Skip to content

Fix resharing of federated shares that were created out of links #19793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MorrisJobke merged 4 commits into from
Apr 27, 2020
Merged

Fix resharing of federated shares that were created out of links #19793

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
45c3ee7
Set proper share type when converting link shares to federated shares
juliusknorr Mar 5, 2020
5646f7c
Link shares have reshare permission if outgoing federated shares are …
juliusknorr Mar 5, 2020
397ab1c
Remove unneeded test since links have resharing permissions by default
juliusknorr Apr 9, 2020
7a9469f
Adjust integration tests to new permissions
juliusknorr Apr 23, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions apps/federatedfilesharing/lib/Controller/MountPublicLinkController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@
use OCP\ISession;
use OCP\IUserSession;
use OCP\Share\IManager;
use OCP\Share\IShare;

/**
* Class MountPublicLinkController
Expand Down Expand Up @@ -155,6 +156,7 @@ public function createFederatedShare($shareWith, $token, $password = '') {
}

$share->setSharedWith($shareWith);
$share->setShareType(IShare::TYPE_REMOTE);

try {
$this->federatedShareProvider->create($share);
Expand Down
13 changes: 8 additions & 5 deletions apps/files_sharing/lib/Controller/ShareAPIController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -492,15 +492,18 @@ public function createShare(
throw new OCSNotFoundException($this->l->t('Public upload is only possible for publicly shared folders'));
}

$share->setPermissions(
Constants::PERMISSION_READ |
$permissions = Constants::PERMISSION_READ |
Constants::PERMISSION_CREATE |
Constants::PERMISSION_UPDATE |
Constants::PERMISSION_DELETE
);
Constants::PERMISSION_DELETE;
} else {
$share->setPermissions(Constants::PERMISSION_READ);
$permissions = Constants::PERMISSION_READ;
}
// TODO: It might make sense to have a dedicated setting to allow/deny converting link shares into federated ones
Copy link
Member

@nickvergessen nickvergessen Mar 5, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the reason is, that you can still mount the dav endpoint as external storage

Copy link
Member Author

@juliusknorr juliusknorr Mar 5, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, so in that case turning of share permissions on a link would be kind of hiding it only anyway.

if ($this->shareManager->outgoingServer2ServerSharesAllowed()) {
$permissions |= Constants::PERMISSION_SHARE;
Copy link
Member

@skjnldsv skjnldsv Apr 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, this actually breaks the UI.
Because suddenly we have SHARE+READ (17) instead of just READ (1).
The front doesn't understand it as it's not part of the available options.

@juliushaertl

Copy link
Member

@skjnldsv skjnldsv Apr 29, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

server/apps/files_sharing/src/components/SharingEntryLink.vue

Lines 352 to 355 in 699cbeb

publicUploadRWValue: OC.PERMISSION_UPDATE | OC.PERMISSION_CREATE | OC.PERMISSION_READ | OC.PERMISSION_DELETE,
publicUploadRValue: OC.PERMISSION_READ,
publicUploadWValue: OC.PERMISSION_CREATE,

Copy link
Member

@skjnldsv skjnldsv Apr 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So it's even worse, we add the Share permission on create
But we always remove it on update. 🤔

server/apps/files_sharing/lib/Controller/ShareAPIController.php

Lines 992 to 993 in cb05782

$newPermissions = (int) $permissions;
$newPermissions = $newPermissions & ~Constants::PERMISSION_SHARE;

Copy link
Member

@skjnldsv skjnldsv Apr 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix in progress in #20726

}
$share->setPermissions($permissions);

// Set password
if ($password !== '') {
Expand Down
7 changes: 5 additions & 2 deletions apps/files_sharing/tests/ApiTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,9 @@ public function testCreateShareLink() {
$ocs->cleanup();

$data = $result->getData();
$this->assertEquals(1, $data['permissions']);
$this->assertEquals(\OCP\Constants::PERMISSION_READ |
\OCP\Constants::PERMISSION_SHARE,
$data['permissions']);
$this->assertEmpty($data['expiration']);
$this->assertTrue(is_string($data['token']));

Expand All @@ -228,7 +230,8 @@ public function testCreateShareLinkPublicUpload() {
\OCP\Constants::PERMISSION_READ |
\OCP\Constants::PERMISSION_CREATE |
\OCP\Constants::PERMISSION_UPDATE |
\OCP\Constants::PERMISSION_DELETE,
\OCP\Constants::PERMISSION_DELETE |
\OCP\Constants::PERMISSION_SHARE,
$data['permissions']
);
$this->assertEmpty($data['expiration']);
Expand Down
6 changes: 3 additions & 3 deletions build/integration/sharing_features/sharing-v1.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ Feature: sharing
And the HTTP status code should be "200"
And Share fields of last share match with
| id | A_NUMBER |
| permissions | 15 |
| permissions | 31 |
| expiration | +3 days |
| url | AN_URL |
| token | A_TOKEN |
Expand Down Expand Up @@ -130,7 +130,7 @@ Feature: sharing
| share_type | 3 |
| file_source | A_NUMBER |
| file_target | /FOLDER |
| permissions | 1 |
| permissions | 17 |
| stime | A_NUMBER |
| expiration | +3 days |
| token | A_TOKEN |
Expand Down Expand Up @@ -163,7 +163,7 @@ Feature: sharing
| share_type | 3 |
| file_source | A_NUMBER |
| file_target | /FOLDER |
| permissions | 1 |
| permissions | 17 |
| stime | A_NUMBER |
| token | A_TOKEN |
| storage | A_NUMBER |
Expand Down
5 changes: 0 additions & 5 deletions lib/private/Share20/Manager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -615,11 +615,6 @@ protected function linkCreateChecks(\OCP\Share\IShare $share) {
throw new \Exception('Link sharing is not allowed');
}

// Link shares by definition can't have share permissions
if ($share->getPermissions() & \OCP\Constants::PERMISSION_SHARE) {
throw new \InvalidArgumentException('Link shares can’t have reshare permissions');
}

// Check if public upload is allowed
if (!$this->shareApiLinkAllowPublicUpload() &&
($share->getPermissions() & (\OCP\Constants::PERMISSION_CREATE | \OCP\Constants::PERMISSION_UPDATE | \OCP\Constants::PERMISSION_DELETE))) {
Expand Down
18 changes: 0 additions & 18 deletions tests/lib/Share20/ManagerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1373,24 +1373,6 @@ public function testLinkCreateChecksNoLinkSharesAllowed() {
}


public function testLinkCreateChecksSharePermissions() {
$this->expectException(\Exception::class);
$this->expectExceptionMessage('Link shares can’t have reshare permissions');

$share = $this->manager->newShare();

$share->setPermissions(\OCP\Constants::PERMISSION_SHARE);

$this->config
->method('getAppValue')
->willReturnMap([
['core', 'shareapi_allow_links', 'yes', 'yes'],
]);

self::invokePrivate($this->manager, 'linkCreateChecks', [$share]);
}


public function testLinkCreateChecksNoPublicUpload() {
$this->expectException(\Exception::class);
$this->expectExceptionMessage('Public upload is not allowed');
Expand Down