Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

usershareprovider: Prevent setting container specific permissions on files #4462

Merged
merged 1 commit into from
Jan 19, 2024
Merged

usershareprovider: Prevent setting container specific permissions on files #4462

merged 1 commit into from
Jan 19, 2024

Conversation

rhafer
Copy link
Contributor

@rhafer rhafer commented Jan 18, 2024

It was possible to set the 'CreateContainer', 'Move' or 'Delete' permissions on file resources with a CreateShare request. These permissions are meant to be only set on container resources. The UpdateShare request already has a similar check.

Parial Fix: owncloud/ocis#8131

@rhafer rhafer marked this pull request as ready for review January 18, 2024 11:14
@rhafer rhafer requested review from labkode, glpatcern and a team as code owners January 18, 2024 11:14
@rhafer
usershareprovider: Prevent setting container specific permissions on …
0683f55 
…files

It was possible to set the 'CreateContainer', 'Move' or 'Delete' permissions on
file resources with a CreateShare request. These permissions are meant to be only
set on container resources. The UpdateShare request already has a similar check.

Partial Fix: owncloud/ocis#8131
@rhafer rhafer mentioned this pull request Jan 19, 2024
Merged
@rhafer rhafer self-assigned this Jan 19, 2024
kobergj
kobergj approved these changes Jan 19, 2024
View reviewed changes
Copy link
Contributor

@kobergj kobergj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I get that CreateContainer and Move make no sense on a share. But why are we blocking Delete?

Just out of curiosity. Code looks good 👍

@rhafer
Copy link
Contributor Author

rhafer commented Jan 19, 2024

But why are we blocking Delete? Just out of curiosity. Code looks good 👍

AFAIU the Delete permission is intended for Folder/Containers to indicate that you are allowed to delete content in them. (Similar to how on a posix file system to need wx permission on the folder to be able to delete files in there. But you don't need write permission on the file itself)

@rhafer rhafer merged commit 537c934 into cs3org:edge Jan 19, 2024
9 checks passed
@saw-jan saw-jan mentioned this pull request Jan 22, 2024
Closed
@micbar micbar mentioned this pull request Jan 26, 2024
Closed
71 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kobergj kobergj kobergj approved these changes

@labkode labkode Awaiting requested review from labkode labkode is a code owner

@glpatcern glpatcern Awaiting requested review from glpatcern glpatcern is a code owner

Assignees

@rhafer rhafer

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@rhafer @kobergj