Skip to content
This repository has been archived by the owner on Jan 18, 2021. It is now read-only.

a share with invalid permissions can be created #45

Closed
individual-it opened this issue Jan 28, 2020 · 3 comments
Closed

a share with invalid permissions can be created #45

individual-it opened this issue Jan 28, 2020 · 3 comments
Labels
bug Something isn't working

Comments

@individual-it
Copy link
Member

individual-it commented Jan 28, 2020

sharing a resource with permission 0 or 32 should fail with HTTP 400

@individual-it individual-it changed the title a share with 0 permissions can be created a share with invalid permissions can be created Jan 28, 2020
@C0rby
Copy link
Contributor

C0rby commented Feb 10, 2020

Just some notes from my debugging sessions:
In internal/http/services/owncloud/ocs/shares.go#createShare the following things happen.
The persmissions 0 and 32 are mapped to the role legacy. Further down in role2CS3Permissions the role legacy is unknown so an error is returned.
Now with asCS3Permissions we check if the permission is a CS3 permission.
We create a new ResourcePermission instance and check if any of the CS3 permissions match, they don't but we already created a new permission instance (with default values) and return it.
Now the method continues as ususal and calls CreateShare on the gateway which routes the request to the handler and from now on the permissions are never checked but the share will be created.

My guess is that the support for legacy roles is missing.

@butonic
Copy link
Member

butonic commented Mar 20, 2020

some response codes got better with #113

see owncloud/core#37149

@PVince81
Copy link
Contributor

PVince81 commented Jun 5, 2020

@C0rby can you close if this is fixed ?

@C0rby C0rby closed this as completed Jun 5, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

4 participants