Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't return files when accessing a share files drop #839

Merged
merged 4 commits into from
May 12, 2021
Merged

Don't return files when accessing a share files drop #839

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a8f7af4
Don't return files when accessing a share files drop
JammingBen May 4, 2021
da93f6a
Add unit test, add check for the API controller also
JammingBen May 4, 2021
adabf42
Optimize permission check
JammingBen May 10, 2021
921919a
Remove unnecessary files
JammingBen May 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions appinfo/application.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,8 @@ public function __construct(array $urlParams = []) {
$c->query('ConfigService'),
$c->query('SearchMediaService'),
$c->query('DownloadService'),
$c->query('Logger')
$c->query('Logger'),
$c->query('OCP\Share\IManager')
);
}
);
Expand All @@ -140,7 +141,8 @@ public function __construct(array $urlParams = []) {
$c->query('ConfigService'),
$c->query('SearchMediaService'),
$c->query('DownloadService'),
$c->query('Logger')
$c->query('Logger'),
$c->query('OCP\Share\IManager')
);
}
);
Expand All @@ -154,7 +156,8 @@ public function __construct(array $urlParams = []) {
$c->query('ConfigService'),
$c->query('SearchMediaService'),
$c->query('DownloadService'),
$c->query('Logger')
$c->query('Logger'),
$c->query('OCP\Share\IManager')
);
}
);
Expand Down
20 changes: 19 additions & 1 deletion controller/filesapicontroller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
use OCA\Gallery\Service\SearchMediaService;
use OCA\Gallery\Service\DownloadService;
use OCA\Gallery\Service\ServiceException;
use OCP\Share\IManager;

/**
* Class FilesApiController
Expand All @@ -39,6 +40,9 @@ class FilesApiController extends ApiController {
/** @var IURLGenerator */
private $urlGenerator;

/** @var IManager */
private $shareManager;

/**
* Constructor
*
Expand All @@ -50,6 +54,7 @@ class FilesApiController extends ApiController {
* @param SearchMediaService $searchMediaService
* @param DownloadService $downloadService
* @param ILogger $logger
* @param IManager $shareManager
*/
public function __construct(
$appName,
Expand All @@ -59,7 +64,8 @@ public function __construct(
ConfigService $configService,
SearchMediaService $searchMediaService,
DownloadService $downloadService,
ILogger $logger
ILogger $logger,
IManager $shareManager
) {
parent::__construct($appName, $request);

Expand All @@ -69,6 +75,7 @@ public function __construct(
$this->searchMediaService = $searchMediaService;
$this->downloadService = $downloadService;
$this->logger = $logger;
$this->shareManager = $shareManager;
}

/**
Expand All @@ -90,6 +97,17 @@ public function __construct(
public function getList($location, $features, $etag, $mediatypes) {
$featuresArray = \explode(';', $features);
$mediaTypesArray = \explode(';', $mediatypes);

$token = $this->request->getParam('token');
if ($token) {
$share = $this->shareManager->getShareByToken($token);

// Prevent user to see directory content if share is a file drop
if (($share->getPermissions() & \OCP\Constants::PERMISSION_READ) !== \OCP\Constants::PERMISSION_READ) {
return $this->formatResults([], [], [], "", "");
}
}

try {
return $this->getFilesAndAlbums($location, $featuresArray, $etag, $mediaTypesArray);
} catch (\Exception $exception) {
Expand Down
20 changes: 19 additions & 1 deletion controller/filescontroller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
use OCA\Gallery\Service\SearchMediaService;
use OCA\Gallery\Service\DownloadService;
use OCA\Gallery\Service\ServiceException;
use OCP\Share\IManager;

/**
* Class FilesController
Expand All @@ -39,6 +40,9 @@ class FilesController extends Controller {
/** @var IURLGenerator */
private $urlGenerator;

/** @var IManager */
private $shareManager;

/**
* Constructor
*
Expand All @@ -50,6 +54,7 @@ class FilesController extends Controller {
* @param SearchMediaService $searchMediaService
* @param DownloadService $downloadService
* @param ILogger $logger
* @param IManager $shareManager
*/
public function __construct(
$appName,
Expand All @@ -59,7 +64,8 @@ public function __construct(
ConfigService $configService,
SearchMediaService $searchMediaService,
DownloadService $downloadService,
ILogger $logger
ILogger $logger,
IManager $shareManager
) {
parent::__construct($appName, $request);

Expand All @@ -69,6 +75,7 @@ public function __construct(
$this->searchMediaService = $searchMediaService;
$this->downloadService = $downloadService;
$this->logger = $logger;
$this->shareManager = $shareManager;
}

/**
Expand All @@ -93,6 +100,17 @@ public function __construct(
public function getList($location, $features, $etag, $mediatypes) {
$featuresArray = \explode(';', $features);
$mediaTypesArray = \explode(';', $mediatypes);

$token = $this->request->getParam('token');
if ($token) {
$share = $this->shareManager->getShareByToken($token);

// Prevent user to see directory content if share is a file drop
if (($share->getPermissions() & \OCP\Constants::PERMISSION_READ) !== \OCP\Constants::PERMISSION_READ) {
return $this->formatResults([], [], [], "", "");
}
}

try {
return $this->getFilesAndAlbums($location, $featuresArray, $etag, $mediaTypesArray);
} catch (\Exception $exception) {
Expand Down
3 changes: 2 additions & 1 deletion tests/unit/controller/FilesApiControllerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ public function setUp(): void {
$this->configService,
$this->searchMediaService,
$this->downloadService,
$this->logger
$this->logger,
$this->shareManager
);
}

Expand Down
43 changes: 42 additions & 1 deletion tests/unit/controller/FilesControllerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@
use OCA\Gallery\Service\SearchMediaService;
use OCA\Gallery\Service\DownloadService;
use OCA\Gallery\Service\NotFoundServiceException;
use OCP\Share\IManager;
use OCP\Share\IShare;

/**
* Class FilesControllerTest
Expand Down Expand Up @@ -60,6 +62,8 @@ class FilesControllerTest extends \Test\GalleryUnitTest {
protected $downloadService;
/** @var ILogger */
protected $logger;
/** @var IManager */
protected $shareManager;

/**
* Test set up
Expand Down Expand Up @@ -94,6 +98,10 @@ public function setUp(): void {
$this->logger = $this->getMockBuilder('\OCP\ILogger')
->disableOriginalConstructor()
->getMock();
$this->shareManager = $this->getMockBuilder('\OCP\Share\IManager')
->disableOriginalConstructor()
->getMock();

$this->controller = new FilesController(
$this->appName,
$this->request,
Expand All @@ -102,7 +110,8 @@ public function setUp(): void {
$this->configService,
$this->searchMediaService,
$this->downloadService,
$this->logger
$this->logger,
$this->shareManager
);
}

Expand Down Expand Up @@ -310,6 +319,38 @@ public function testGetReducedPath($file, $fixedPath, $folderPathFromRoot) {
$this->assertEquals($fixedPath, $response);
}

public function testGetFilesWithFileDropShare() {
$location = 'folder';
$etag = 1111222233334444;
$features = '';
$mediatypes = 'image/png';

$this->request->expects($this->once())
->method('getParam')
->willReturn('param');

$shareMock = $this->createMock(IShare::class);
$shareMock->expects($this->once())
->method('getPermissions')
->willReturn(\OCP\Constants::PERMISSION_CREATE);

$this->shareManager->expects($this->once())
->method('getShareByToken')
->willReturn($shareMock);

$response = $this->controller->getList($location, $features, $etag, $mediatypes);

$expectedResponse = [
'files' => [],
'albums' => [],
'albumconfig' => [],
'albumpath' => "",
'updated' => ""
];

$this->assertEquals($expectedResponse, $response);
}

/**
* Mocks IURLGenerator->linkToRoute
*
Expand Down
3 changes: 2 additions & 1 deletion tests/unit/controller/FilesPublicControllerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,8 @@ public function setUp(): void {
$this->configService,
$this->searchMediaService,
$this->downloadService,
$this->logger
$this->logger,
$this->shareManager
);
}
}