add some additonal permission checks to the webdav backend #255
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
schiessle
force-pushed
the
dav-permission-check
branch
from
3182f86 to
93c8458
Compare
Member
|
Thanks, @schiessle. I'll see if I can write an integration test for this. |
Member
... or even better: let @schiessle try to add this ;) |
Member
Ah. I guess he'll be busy fixing the theming PR 🙈 |
Member
|
Integration tests passed. They should pass, but there are some broken unit tests, @schiessle mind taking a look at those? |
LukasReschke
force-pushed
the
dav-permission-check
branch
from
eae9b92 to
f43fba4
Compare
LukasReschke
force-pushed
the
dav-permission-check
branch
from
f43fba4 to
4e21543
Compare
| $sourcePermission = $infoSource && $infoSource->isDeletable(); | ||
|
|
||
| if (!$destinationPermission || !$sourcePermission) { | ||
| throw new Forbidden(); |
Member
There was a problem hiding this comment.
Required parameter $message missing
MorrisJobke
added
2. developing
Member
|
Tests should pass now after ea18d86 |
| $info = $this->fileView->getFileInfo(dirname($destination)); | ||
| if ($info && !$info->isUpdateable()) { | ||
| throw new Forbidden(); | ||
| throw new Forbidden('No permissions to move object.'); |
Member
Author
There was a problem hiding this comment.
"copy" in this case? 😉
Member
|
Tested and works 👍 |
MorrisJobke
added
3. to review
Member
Author
|
👍 for the tests |
|
|
||
|
|
||
| $info = $this->fileView->getFileInfo(dirname($destination)); | ||
| if ($info && !$info->isUpdateable()) { |
Member
There was a problem hiding this comment.
Might not be 100% correct. A copy needs create permissions for a "copy in" as new file.
As for "copy + overwrite" it's "create + delete", because SabreDAV will trigger an automatic delete of the target before running this method. So in the end only a check on "create" is needed.
Even though the "update" permission semantically seems to fit better for overwrites, it never quite worked as expected.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
@LukasReschke another one for you 😉