Correctly check if the share has a password and if it was entered cor…

…rectly.

This prevents joining the room for a file shared by link and protected
by password if the password has not been entered yet.

Signed-off-by: Joas Schilling <[email protected]>

lib/Controller/PublicShareController.php

@@ -33,6 +33,7 @@
 use OCP\Files\FileInfo;
 use OCP\Files\NotFoundException;
 use OCP\IRequest;
+use OCP\ISession;
 use OCP\Share\Exceptions\ShareNotFound;
 use OCP\Share\IManager as ShareManager;
 use OCP\Share\IShare;
@@ -41,6 +42,8 @@ class PublicShareController extends OCSController {
 
 	/** @var ShareManager */
 	private $shareManager;
+	/** @var ISession */
+	private $session;
 	/** @var TalkSession */
 	private $talkSession;
 	/** @var Manager */
@@ -50,11 +53,13 @@ public function __construct(
 			$appName,
 			IRequest $request,
 			ShareManager $shareManager,
+			ISession $session,
 			TalkSession $talkSession,
 			Manager $manager
 	) {
 		parent::__construct($appName, $request);
 		$this->shareManager = $shareManager;
+		$this->session = $session;
 		$this->talkSession = $talkSession;
 		$this->manager = $manager;
 	}
@@ -89,6 +94,12 @@ public function __construct(
 	public function getRoom(string $shareToken) {
 		try {
 			$share = $this->shareManager->getShareByToken($shareToken);
+			if ($share->getPassword() !== null) {
+				$shareId = $this->session->get('public_link_authenticated');
+				if ($share->getId() !== $shareId) {
+					throw new ShareNotFound();
+				}
+			}
 		} catch (ShareNotFound $e) {
 			return new DataResponse([], Http::STATUS_NOT_FOUND);
 		}

lib/Files/Util.php

@@ -28,6 +28,7 @@
 use OCP\Files\IRootFolder;
 use OCP\Files\Node;
 use OCP\Files\NotFoundException;
+use OCP\ISession;
 use OCP\Share\Exceptions\ShareNotFound;
 use OCP\Share\IManager as IShareManager;
 use OCP\Share\IShare;
@@ -36,14 +37,18 @@ class Util {
 
 	/** @var IRootFolder */
 	private $rootFolder;
+	/** @var ISession */
+	private $session;
 	/** @var IShareManager */
 	private $shareManager;
 	/** @var array[] */
 	private $accessLists = [];
 
 	public function __construct(IRootFolder $rootFolder,
+			ISession $session,
 			IShareManager $shareManager) {
 		$this->rootFolder = $rootFolder;
+		$this->session = $session;
 		$this->shareManager = $shareManager;
 	}
 
@@ -70,7 +75,13 @@ public function canUserAccessFile(string $fileId, string $userId): bool {
 
 	public function canGuestAccessFile(string $shareToken): bool {
 		try {
-			$this->shareManager->getShareByToken($shareToken);
+			$share = $this->shareManager->getShareByToken($shareToken);
+			if ($share->getPassword() !== null) {
+				$shareId = $this->session->get('public_link_authenticated');
+				if ($share->getId() !== $shareId) {
+					throw new ShareNotFound();
+				}
+			}
 			return true;
 		} catch (ShareNotFound $e) {
 			return false;

tests/php/Files/UtilTest.php

@@ -29,6 +29,7 @@
 use OCP\Files\Node;
 use OCP\Files\IRootFolder;
 use OCP\Files\Storage\IStorage;
+use OCP\ISession;
 use OCP\Share\IManager;
 use PHPUnit\Framework\MockObject\MockObject;
 use Test\TestCase;
@@ -94,11 +95,15 @@ public function testGetGroupFolderNode(string $fileId, string $userId, array $no
 			->with($userId)
 			->willReturn($userFolder);
 
+		/** @var ISession|MockObject $session */
+		$session = $this->createMock(ISession::class);
+
 		/** @var IManager|MockObject $shareManager */
 		$shareManager = $this->createMock(IManager::class);
 
 		$util = new Util(
 			$rootFolder,
+			$session,
 			$shareManager
 		);
 		$result = $util->getGroupFolderNode($fileId, $userId);