Skip to content

Commit

Permalink
fix(isLegitimatedForUserId): Setup mountpoints to check file access
Browse files Browse the repository at this point in the history
This fixes workflows on groupfolders, as it will consider access to
files in groupfolders.

It also fixes false positives where access to files was limited by other
means not taken into account before, e.g. access control.

Fixes: nextcloud/flow_notifications#71

Signed-off-by: Jonas <jonas@freesources.org>
  • Loading branch information
mejo- committed Sep 20, 2023
1 parent 6714e51 commit a4d98c8
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 12 deletions.
25 changes: 14 additions & 11 deletions apps/workflowengine/lib/Entity/File.php
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
*/
namespace OCA\WorkflowEngine\Entity;

use OC\Files\Config\UserMountCache;
use OCP\EventDispatcher\Event;
use OCP\EventDispatcher\GenericEvent;
use OCP\Files\InvalidPathException;
Expand All @@ -38,7 +39,6 @@
use OCP\IUser;
use OCP\IUserManager;
use OCP\IUserSession;
use OCP\Share\IManager as ShareManager;
use OCP\SystemTag\ISystemTag;
use OCP\SystemTag\ISystemTagManager;
use OCP\SystemTag\MapperEvent;
Expand All @@ -65,8 +65,6 @@ class File implements IEntity, IDisplayText, IUrl, IIcon, IContextPortation {
protected $eventName;
/** @var Event */
protected $event;
/** @var ShareManager */
private $shareManager;
/** @var IUserSession */
private $userSession;
/** @var ISystemTagManager */
Expand All @@ -77,25 +75,27 @@ class File implements IEntity, IDisplayText, IUrl, IIcon, IContextPortation {
private $actingUser = null;
/** @var IUserManager */
private $userManager;
/** @var UserMountCache */
private $userMountCache;

public function __construct(
IL10N $l10n,
IURLGenerator $urlGenerator,
IRootFolder $root,
ILogger $logger,
ShareManager $shareManager,
IUserSession $userSession,
ISystemTagManager $tagManager,
IUserManager $userManager
IUserManager $userManager,
UserMountCache $userMountCache
) {
$this->l10n = $l10n;
$this->urlGenerator = $urlGenerator;
$this->root = $root;
$this->logger = $logger;
$this->shareManager = $shareManager;
$this->userSession = $userSession;
$this->tagManager = $tagManager;
$this->userManager = $userManager;
$this->userMountCache = $userMountCache;
}

public function getName(): string {
Expand Down Expand Up @@ -136,12 +136,15 @@ public function prepareRuleMatcher(IRuleMatcher $ruleMatcher, string $eventName,

public function isLegitimatedForUserId(string $uid): bool {
try {
$node = $this->getNode();
if ($node->getOwner()->getUID() === $uid) {
return true;
$fileId = $this->getNode()->getId();
$mounts = $this->userMountCache->getMountsForFileId($fileId, $uid);
foreach ($mounts as $mount) {
$userFolder = $this->root->getUserFolder($uid);
if (!empty($userFolder->getById($fileId))) {
return true;
}
}
$acl = $this->shareManager->getAccessList($node, true, true);
return isset($acl['users']) && array_key_exists($uid, $acl['users']);
return false;
} catch (NotFoundException $e) {
return false;
}
Expand Down
3 changes: 2 additions & 1 deletion apps/workflowengine/tests/ManagerTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
*/
namespace OCA\WorkflowEngine\Tests;

use OC\Files\Config\UserMountCache;
use OC\L10N\L10N;
use OCA\WorkflowEngine\Entity\File;
use OCA\WorkflowEngine\Helper\ScopeContext;
Expand Down Expand Up @@ -406,8 +407,8 @@ public function testUpdateOperation() {
$this->createMock(ILogger::class),
$this->createMock(\OCP\Share\IManager::class),
$this->createMock(IUserSession::class),
$this->createMock(ISystemTagManager::class),
$this->createMock(IUserManager::class),
$this->createMock(UserMountCache::class),
])
->setMethodsExcept(['getEvents'])
->getMock();
Expand Down

0 comments on commit a4d98c8

Please sign in to comment.