Skip to content

add some additonal permission checks to the webdav backend #255

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
schiessle merged 6 commits into from
Jun 30, 2016
Merged

add some additonal permission checks to the webdav backend #255

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
93c8458
add some additonal permission checks to the webdav backend
schiessle Jun 30, 2016
4e21543
Add integration tests
LukasReschke Jun 30, 2016
54ab972
Add required $message parameter
LukasReschke Jun 30, 2016
62cc9f9
Add proper throws PHP docs
LukasReschke Jun 30, 2016
ea18d86
Fix tests
LukasReschke Jun 30, 2016
726052b
fix error message
schiessle Jun 30, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 29 additions & 3 deletions apps/dav/lib/Connector/Sabre/ObjectTree.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ public function init(\Sabre\DAV\INode $rootNode, \OC\Files\View $view, \OCP\File
* is present.
*
* @param string $path chunk file path to convert
*
*
* @return string path to real file
*/
private function resolveChunkFile($path) {
Expand Down Expand Up @@ -186,16 +186,29 @@ public function getNodeForPath($path) {
*
* @param string $sourcePath The path to the file which should be moved
* @param string $destinationPath The full destination path, so not just the destination parent node
* @throws \Sabre\DAV\Exception\BadRequest
* @throws \Sabre\DAV\Exception\ServiceUnavailable
* @throws FileLocked
* @throws Forbidden
* @throws InvalidPath
* @throws \Sabre\DAV\Exception\Forbidden
* @throws \Sabre\DAV\Exception\Locked
* @throws \Sabre\DAV\Exception\NotFound
* @throws \Sabre\DAV\Exception\ServiceUnavailable
* @return int
*/
public function move($sourcePath, $destinationPath) {
if (!$this->fileView) {
throw new \Sabre\DAV\Exception\ServiceUnavailable('filesystem not setup');
}

$infoDestination = $this->fileView->getFileInfo(dirname($destinationPath));
$infoSource = $this->fileView->getFileInfo($sourcePath);
$destinationPermission = $infoDestination && $infoDestination->isUpdateable();
$sourcePermission = $infoSource && $infoSource->isDeletable();

if (!$destinationPermission || !$sourcePermission) {
throw new Forbidden('No permissions to move object.');
}

$targetNodeExists = $this->nodeExists($destinationPath);
$sourceNode = $this->getNodeForPath($sourcePath);
if ($sourceNode instanceof \Sabre\DAV\ICollection && $targetNodeExists) {
Expand Down Expand Up @@ -265,6 +278,13 @@ public function move($sourcePath, $destinationPath) {
*
* @param string $source
* @param string $destination
* @throws FileLocked
* @throws Forbidden
* @throws InvalidPath
* @throws \Exception
* @throws \Sabre\DAV\Exception\Forbidden
* @throws \Sabre\DAV\Exception\Locked
* @throws \Sabre\DAV\Exception\NotFound
* @throws \Sabre\DAV\Exception\ServiceUnavailable
* @return void
*/
Expand All @@ -273,6 +293,12 @@ public function copy($source, $destination) {
throw new \Sabre\DAV\Exception\ServiceUnavailable('filesystem not setup');
}


$info = $this->fileView->getFileInfo(dirname($destination));
if ($info && !$info->isUpdateable()) {
Copy link
Member

@PVince81 PVince81 Jul 6, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might not be 100% correct. A copy needs create permissions for a "copy in" as new file.
As for "copy + overwrite" it's "create + delete", because SabreDAV will trigger an automatic delete of the target before running this method. So in the end only a check on "create" is needed.

Even though the "update" permission semantically seems to fit better for overwrites, it never quite worked as expected.

throw new Forbidden('No permissions to copy object.');
}

// this will trigger existence check
$this->getNodeForPath($source);

Expand Down
20 changes: 20 additions & 0 deletions apps/dav/tests/unit/Connector/Sabre/ObjectTreeTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ public function __construct($updatables, $deletables, $canRename = true) {
$this->updatables = $updatables;
$this->deletables = $deletables;
$this->canRename = $canRename;
$this->lockingProvider = \OC::$server->getLockingProvider();
}

public function isUpdatable($path) {
Expand All @@ -56,6 +57,11 @@ public function rename($path1, $path2) {
public function getRelativePath($path) {
return $path;
}

public function getFileInfo($path, $includeMountPoints = true) {
$objectTreeTest = new ObjectTreeTest();
return $objectTreeTest->getFileInfoMock();
}
}

/**
Expand All @@ -67,6 +73,20 @@ public function getRelativePath($path) {
*/
class ObjectTreeTest extends \Test\TestCase {

public function getFileInfoMock() {
$mock = $this->getMock('\OCP\Files\FileInfo');
$mock
->expects($this->any())
->method('isDeletable')
->willReturn(true);
$mock
->expects($this->any())
->method('isUpdateable')
->willReturn(true);

return $mock;
}

/**
* @dataProvider moveFailedProvider
* @expectedException \Sabre\DAV\Exception\Forbidden
Expand Down
18 changes: 18 additions & 0 deletions build/integration/features/bootstrap/WebDav.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ public function makeDavRequest($user, $method, $path, $headers, $body = null){
$request->setBody($body);
}


return $client->send($request);
}

Expand Down Expand Up @@ -70,6 +71,23 @@ public function userMovesFile($user, $fileSource, $fileDestination){
$this->response = $this->makeDavRequest($user, "MOVE", $fileSource, $headers);
}

/**
* @When /^User "([^"]*)" copies file "([^"]*)" to "([^"]*)"$/
* @param string $user
* @param string $fileSource
* @param string $fileDestination
*/
public function userCopiesFileTo($user, $fileSource, $fileDestination) {
$fullUrl = substr($this->baseUrl, 0, -4) . $this->davPath;
$headers['Destination'] = $fullUrl . $fileDestination;
try {
$this->response = $this->makeDavRequest($user, 'COPY', $fileSource, $headers);
} catch (\GuzzleHttp\Exception\ClientException $e) {
// 4xx and 5xx responses cause an exception
$this->response = $e->getResponse();
}
}

/**
* @When /^Downloading file "([^"]*)" with range "([^"]*)"$/
* @param string $fileSource
Expand Down
29 changes: 29 additions & 0 deletions build/integration/features/webdav-related.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,3 +257,32 @@ Feature: webdav-related
When Downloading file "/welcome.txt" as "userToBeDisabled"
Then the HTTP status code should be "503"

Scenario: Copying files into a folder with edit permissions
Given using dav path "remote.php/webdav"
And user "user0" exists
And user "user1" exists
And As an "user1"
And user "user1" created a folder "/testcopypermissionsAllowed"
And as "user1" creating a share with
| path | testcopypermissionsAllowed |
| shareType | 0 |
| permissions | 31 |
| shareWith | user0 |
And User "user0" uploads file with content "copytest" to "/copytest.txt"
When User "user0" copies file "/copytest.txt" to "/testcopypermissionsAllowed/copytest.txt"
Then the HTTP status code should be "201"

Scenario: Copying files into a folder without edit permissions
Given using dav path "remote.php/webdav"
And user "user0" exists
And user "user1" exists
And As an "user1"
And user "user1" created a folder "/testcopypermissionsNotAllowed"
And as "user1" creating a share with
| path | testcopypermissionsNotAllowed |
| shareType | 0 |
| permissions | 1 |
| shareWith | user0 |
And User "user0" uploads file with content "copytest" to "/copytest.txt"
When User "user0" copies file "/copytest.txt" to "/testcopypermissionsNotAllowed/copytest.txt"
Then the HTTP status code should be "403"