From 7289cb5ec0b812992ab0dfb889744b94bc0994f0 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Thu, 28 Jul 2016 16:52:00 +0200
Subject: [PATCH 1/2] Do not allow to delete/update group shares as a group
 member

---
 apps/files_sharing/lib/API/Share20OCS.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/files_sharing/lib/API/Share20OCS.php b/apps/files_sharing/lib/API/Share20OCS.php
index fd5e5ddc786f2..593e9d877c70d 100644
--- a/apps/files_sharing/lib/API/Share20OCS.php
+++ b/apps/files_sharing/lib/API/Share20OCS.php
@@ -224,7 +224,7 @@ public function deleteShare($id) {
 			return new \OC_OCS_Result(null, 404, 'could not delete share');
 		}
 
-		if (!$this->canAccessShare($share)) {
+		if (!$this->canAccessShare($share, false)) {
 			$share->getNode()->unlock(ILockingProvider::LOCK_SHARED);
 			return new \OC_OCS_Result(null, 404, $this->l->t('Could not delete share'));
 		}
@@ -573,7 +573,7 @@ public function updateShare($id) {
 
 		$share->getNode()->lock(\OCP\Lock\ILockingProvider::LOCK_SHARED);
 
-		if (!$this->canAccessShare($share)) {
+		if (!$this->canAccessShare($share, false)) {
 			$share->getNode()->unlock(ILockingProvider::LOCK_SHARED);
 			return new \OC_OCS_Result(null, 404, $this->l->t('Wrong share ID, share doesn\'t exist'));
 		}
@@ -703,7 +703,7 @@ public function updateShare($id) {
 	 * @param \OCP\Share\IShare $share
 	 * @return bool
 	 */
-	protected function canAccessShare(\OCP\Share\IShare $share) {
+	protected function canAccessShare(\OCP\Share\IShare $share, $checkGroups = true) {
 		// A file with permissions 0 can't be accessed by us. So Don't show it
 		if ($share->getPermissions() === 0) {
 			return false;
@@ -722,7 +722,7 @@ protected function canAccessShare(\OCP\Share\IShare $share) {
 			return true;
 		}
 
-		if ($share->getShareType() === \OCP\Share::SHARE_TYPE_GROUP) {
+		if ($checkGroups && $share->getShareType() === \OCP\Share::SHARE_TYPE_GROUP) {
 			$sharedWith = $this->groupManager->get($share->getSharedWith());
 			if ($sharedWith->inGroup($this->currentUser)) {
 				return true;

From e2c4f4f9aa11bc92e8f2212cce73841b922187e8 Mon Sep 17 00:00:00 2001
From: Roeland Jago Douma <roeland@famdouma.nl>
Date: Tue, 2 Aug 2016 10:58:27 +0200
Subject: [PATCH 2/2] Add intergration test

---
 build/integration/features/sharing-v1.feature | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/build/integration/features/sharing-v1.feature b/build/integration/features/sharing-v1.feature
index 75f98521e3a05..cd5be9cfe526e 100644
--- a/build/integration/features/sharing-v1.feature
+++ b/build/integration/features/sharing-v1.feature
@@ -759,3 +759,19 @@ Feature: sharing
       | shareType | 0 |
     Then the OCS status code should be "997"
     And the HTTP status code should be "401"
+
+  Scenario: Deleting a group share as user
+    Given As an "admin"
+    And user "user0" exists
+    And user "user1" exists
+    And group "group1" exists
+    And user "user1" belongs to group "group1"
+    And As an "user0"
+    And creating a share with
+      | path | welcome.txt |
+      | shareType | 1 |
+      | shareWith | group1 |
+    When As an "user1"
+    And Deleting last share
+    Then the OCS status code should be "404"
+    And the HTTP status code should be "200"