Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix permissions for share jail #1939

Merged
merged 1 commit into from
Aug 2, 2021
Merged

Conversation

micbar
Copy link
Member

@micbar micbar commented Jul 30, 2021

Description

The shared jail should not be writable.

closes owncloud/ocis#2322

@aduffeck @refs @ishank011 This will only be temporary, until we remove all "Share" awareness and logic from the storage.

@micbar micbar requested a review from labkode as a code owner July 30, 2021 13:30
@micbar micbar requested review from ishank011 and butonic July 30, 2021 13:31
@micbar micbar force-pushed the fix-shared-jail branch from fb1efe4 to bd6e080 Compare July 30, 2021 14:18
@ishank011
Copy link
Contributor

@micbar micbar force-pushed the fix-shared-jail branch from bd6e080 to 664f5b2 Compare July 30, 2021 14:43
@micbar
Copy link
Member Author

micbar commented Jul 30, 2021

It should already be handled, no? https://github.com/cs3org/reva/blob/master/internal/grpc/services/gateway/storageprovider.go#L531-L657

yes, this is already forbidden.

But to get the information to the Client, the webDAV permissions should not indicate write possibilities.

So we need to return the permissions also from the decomposedfs

See Example WebDAV response after the fix

<?xml version="1.0" encoding="utf-8"?>
<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns">
    <d:response>
        <d:href>/dav/files/einstein/Shares/</d:href>
        <d:propstat>
            <d:prop>
                <oc:id>MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3OmY0MjQ4MDBmLTc5YjItNDZhNi05NzQ2LTFmM2I4MmEwYjViYw==</oc:id>
                <oc:fileid>MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3OmY0MjQ4MDBmLTc5YjItNDZhNi05NzQ2LTFmM2I4MmEwYjViYw==</oc:fileid>
                <d:getetag>&#34;05e827b715f0da007b7adc800703bb1e&#34;</d:getetag>
                <oc:permissions></oc:permissions>
                <d:resourcetype>
                    <d:collection/>
                </d:resourcetype>
                <oc:size>0</oc:size>
                <d:getlastmodified>Tue, 27 Jul 2021 14:38:25 GMT</d:getlastmodified>
                <oc:favorite>0</oc:favorite>
            </d:prop>
            <d:status>HTTP/1.1 200 OK</d:status>
        </d:propstat>
    </d:response>
    <d:response>
        <d:href>/dav/files/einstein/Shares/NewFolder/</d:href>
        <d:propstat>
            <d:prop>
                <oc:id>MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3OjNjY2RhNzUyLWFiMWQtNGEzMS05YWFkLWVjNjA2ZmY4MDZkYw==</oc:id>
                <oc:fileid>MTI4NGQyMzgtYWE5Mi00MmNlLWJkYzQtMGIwMDAwMDA5MTU3OjNjY2RhNzUyLWFiMWQtNGEzMS05YWFkLWVjNjA2ZmY4MDZkYw==</oc:fileid>
                <d:getetag>&#34;74d129b6a9a38d48976c1dee64a9bd53&#34;</d:getetag>
                <oc:permissions>S</oc:permissions>
                <d:resourcetype>
                    <d:collection/>
                </d:resourcetype>
                <oc:size>0</oc:size>
                <d:getlastmodified>Tue, 27 Jul 2021 14:37:49 GMT</d:getlastmodified>
                <oc:favorite>0</oc:favorite>
            </d:prop>
            <d:status>HTTP/1.1 200 OK</d:status>
        </d:propstat>
    </d:response>
</d:multistatus>

@micbar
Copy link
Member Author

micbar commented Jul 30, 2021

@aduffeck @butonic It turned into a small refactoring. Happy to discuss this in general how we work with pointer variables.

@dragotin FYI

@micbar micbar force-pushed the fix-shared-jail branch from 664f5b2 to 44db434 Compare July 30, 2021 14:57
@micbar micbar force-pushed the fix-shared-jail branch from 44db434 to fc1eae2 Compare July 30, 2021 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Error when user upload files into the folder Shares
3 participants