From 078700984c7736a1fdf49ed5be4d987284dbf160 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julius=20H=C3=A4rtl?= Date: Tue, 30 Apr 2024 15:55:17 +0200 Subject: [PATCH] fix: Block incompatible operations with remote tokens MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With federated tokens we do not allow storage operations that would be relative to the file path so we should block them Signed-off-by: Julius Härtl --- lib/Controller/WopiController.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/Controller/WopiController.php b/lib/Controller/WopiController.php index d11d574fc2..5ed071d06f 100644 --- a/lib/Controller/WopiController.php +++ b/lib/Controller/WopiController.php @@ -163,11 +163,11 @@ public function checkFileInfo($fileId, $access_token) { 'UserExtraInfo' => [], 'UserPrivateInfo' => [], 'UserCanWrite' => $canWriteThroughLock && (bool)$wopi->getCanwrite(), - 'UserCanNotWriteRelative' => $isPublic || $this->encryptionManager->isEnabled() || $wopi->getHideDownload(), + 'UserCanNotWriteRelative' => $isPublic || $this->encryptionManager->isEnabled() || $wopi->getHideDownload() || $wopi->isRemoteToken(), 'PostMessageOrigin' => $wopi->getServerHost(), 'LastModifiedTime' => Helper::toISO8601($file->getMTime()), - 'SupportsRename' => !$isVersion, - 'UserCanRename' => !$isPublic && !$isVersion, + 'SupportsRename' => !$isVersion && !$wopi->isRemoteToken(), + 'UserCanRename' => !$isPublic && !$isVersion && !$wopi->isRemoteToken(), 'EnableInsertRemoteImage' => !$isPublic, 'EnableShare' => $file->isShareable() && !$isVersion && !$isPublic, 'HideUserList' => '',