From af55553256a3cbc1fec31e7b4c7bbcdd6f9fa274 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julius=20H=C3=A4rtl?= Date: Wed, 3 Aug 2022 12:53:25 +0200 Subject: [PATCH 1/3] Block file access for secure view MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julius Härtl --- lib/Service/ApiService.php | 23 ++++++++++++++++++++++- lib/Service/DocumentService.php | 6 +++++- src/components/Editor.vue | 20 +++++++++++++++++--- src/components/Editor/DocumentStatus.vue | 18 +++++++++++++++++- src/services/SyncService.js | 2 +- tests/stub.phpstub | 5 +++++ 6 files changed, 67 insertions(+), 7 deletions(-) diff --git a/lib/Service/ApiService.php b/lib/Service/ApiService.php index e2d9c95f9b2..e9db5a2d127 100644 --- a/lib/Service/ApiService.php +++ b/lib/Service/ApiService.php @@ -28,6 +28,7 @@ use Exception; use OC\Files\Node\File; +use OCA\Files_Sharing\SharedStorage; use OCA\Text\AppInfo\Application; use OCA\Text\Exception\DocumentHasUnsavedChangesException; use OCA\Text\Exception\DocumentSaveConflictException; @@ -41,8 +42,11 @@ use OCP\Constants; use OCP\Files\Lock\ILock; use OCP\Files\NotFoundException; +use OCP\Files\NotPermittedException; +use OCP\IL10N; use OCP\IRequest; use OCP\Lock\LockedException; +use OCP\Share\IShare; use Psr\Log\LoggerInterface; class ApiService { @@ -52,19 +56,23 @@ class ApiService { private LoggerInterface $logger; private AttachmentService $attachmentService; private EncodingService $encodingService; + private IL10N $l10n; public function __construct(IRequest $request, SessionService $sessionService, DocumentService $documentService, AttachmentService $attachmentService, EncodingService $encodingService, - LoggerInterface $logger) { + LoggerInterface $logger, + IL10N $l10n + ) { $this->request = $request; $this->sessionService = $sessionService; $this->documentService = $documentService; $this->logger = $logger; $this->attachmentService = $attachmentService; $this->encodingService = $encodingService; + $this->l10n = $l10n; } public function create($fileId = null, $filePath = null, $token = null, $guestName = null, bool $forceRecreate = false): DataResponse { @@ -81,6 +89,8 @@ public function create($fileId = null, $filePath = null, $token = null, $guestNa $this->documentService->checkSharePermissions($token, Constants::PERMISSION_READ); } catch (NotFoundException $e) { return new DataResponse([], Http::STATUS_NOT_FOUND); + } catch (NotPermittedException $e) { + return new DataResponse($this->l10n->t('This file cannot be displayed as download is disabled by the share'), 404); } } elseif ($fileId) { $file = $this->documentService->getFileById($fileId); @@ -88,6 +98,17 @@ public function create($fileId = null, $filePath = null, $token = null, $guestNa return new DataResponse('No valid file argument provided', 500); } + $storage = $file->getStorage(); + + // Block using text for disabled download internal shares + if ($storage->instanceOfStorage(SharedStorage::class)) { + /** @var IShare $share */ + $share = $storage->getShare(); + if ($share->getAttributes()->getAttribute('permissions', 'download') === false) { + return new DataResponse($this->l10n->t('This file cannot be displayed as download is disabled by the share'), 403); + } + } + $readOnly = $this->documentService->isReadOnly($file, $token); $this->sessionService->removeInactiveSessions($file->getId()); diff --git a/lib/Service/DocumentService.php b/lib/Service/DocumentService.php index a9743cda5fc..0d5435a175c 100644 --- a/lib/Service/DocumentService.php +++ b/lib/Service/DocumentService.php @@ -482,7 +482,7 @@ public function getLockInfo($file): ?ILock { /** * @param $shareToken * @return void - * @throws NotFoundException + * @throws NotFoundException|NotPermittedException */ public function checkSharePermissions($shareToken, $permission = Constants::PERMISSION_READ): void { try { @@ -494,6 +494,10 @@ public function checkSharePermissions($shareToken, $permission = Constants::PERM if (($share->getPermissions() & $permission) === 0) { throw new NotFoundException(); } + + if ($share->getHideDownload()) { + throw new NotPermittedException(); + } } public function hasUnsavedChanges(Document $document) { diff --git a/src/components/Editor.vue b/src/components/Editor.vue index f8d09c075c1..656a5962ad1 100644 --- a/src/components/Editor.vue +++ b/src/components/Editor.vue @@ -21,8 +21,11 @@ -->