Skip to content

add some additonal permission checks to the webdav backend #255

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
schiessle merged 6 commits into from
Jun 30, 2016
Merged

add some additonal permission checks to the webdav backend #255

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
93c8458
add some additonal permission checks to the webdav backend
schiessle Jun 30, 2016
4e21543
Add integration tests
LukasReschke Jun 30, 2016
54ab972
Add required $message parameter
LukasReschke Jun 30, 2016
62cc9f9
Add proper throws PHP docs
LukasReschke Jun 30, 2016
ea18d86
Fix tests
LukasReschke Jun 30, 2016
726052b
fix error message
schiessle Jun 30, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add required $message parameter
  • Loading branch information
@LukasReschke
LukasReschke committed Jun 30, 2016
commit 54ab972f0e45d0c192a705d794f9f4db7397b6e8
4 changes: 2 additions & 2 deletions apps/dav/lib/Connector/Sabre/ObjectTree.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,7 @@ public function move($sourcePath, $destinationPath) {
$sourcePermission = $infoSource && $infoSource->isDeletable();

if (!$destinationPermission || !$sourcePermission) {
throw new Forbidden();
throw new Forbidden('No permissions to move object.');
}

$targetNodeExists = $this->nodeExists($destinationPath);
Expand Down Expand Up @@ -285,7 +285,7 @@ public function copy($source, $destination) {

$info = $this->fileView->getFileInfo(dirname($destination));
if ($info && !$info->isUpdateable()) {
Copy link
Member

@PVince81 PVince81 Jul 6, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might not be 100% correct. A copy needs create permissions for a "copy in" as new file.
As for "copy + overwrite" it's "create + delete", because SabreDAV will trigger an automatic delete of the target before running this method. So in the end only a check on "create" is needed.

Even though the "update" permission semantically seems to fit better for overwrites, it never quite worked as expected.

throw new Forbidden();
throw new Forbidden('No permissions to move object.');
Copy link
Member Author

@schiessle schiessle Jun 30, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"copy" in this case? 😉

}

// this will trigger existence check
Expand Down