From a8c31ad285e30f91ed283076cf1a42b60c865691 Mon Sep 17 00:00:00 2001 From: Jonas Date: Mon, 18 Sep 2023 16:20:17 +0200 Subject: [PATCH 1/2] fix(isLegitimatedForUserId): Setup mountpoints to check file access This fixes workflows on groupfolders, as it will consider access to files in groupfolders. It also fixes false positives where access to files was limited by other means not taken into account before, e.g. access control. For postDelete events, check for permissions of the parent folder instead, as the file itself no longer exists. Fixes: nextcloud/flow_notifications#71 Signed-off-by: Jonas --- apps/workflowengine/lib/Entity/File.php | 30 +++++++++++++++++------ apps/workflowengine/tests/ManagerTest.php | 3 ++- 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/apps/workflowengine/lib/Entity/File.php b/apps/workflowengine/lib/Entity/File.php index 3f09fcd24a146..b6084266c5d98 100644 --- a/apps/workflowengine/lib/Entity/File.php +++ b/apps/workflowengine/lib/Entity/File.php @@ -26,6 +26,7 @@ */ namespace OCA\WorkflowEngine\Entity; +use OC\Files\Config\UserMountCache; use OCP\EventDispatcher\Event; use OCP\EventDispatcher\GenericEvent; use OCP\Files\InvalidPathException; @@ -38,7 +39,6 @@ use OCP\IUser; use OCP\IUserManager; use OCP\IUserSession; -use OCP\Share\IManager as ShareManager; use OCP\SystemTag\ISystemTag; use OCP\SystemTag\ISystemTagManager; use OCP\SystemTag\MapperEvent; @@ -65,8 +65,6 @@ class File implements IEntity, IDisplayText, IUrl, IIcon, IContextPortation { protected $eventName; /** @var Event */ protected $event; - /** @var ShareManager */ - private $shareManager; /** @var IUserSession */ private $userSession; /** @var ISystemTagManager */ @@ -77,25 +75,27 @@ class File implements IEntity, IDisplayText, IUrl, IIcon, IContextPortation { private $actingUser = null; /** @var IUserManager */ private $userManager; + /** @var UserMountCache */ + private $userMountCache; public function __construct( IL10N $l10n, IURLGenerator $urlGenerator, IRootFolder $root, ILogger $logger, - ShareManager $shareManager, IUserSession $userSession, ISystemTagManager $tagManager, - IUserManager $userManager + IUserManager $userManager, + UserMountCache $userMountCache ) { $this->l10n = $l10n; $this->urlGenerator = $urlGenerator; $this->root = $root; $this->logger = $logger; - $this->shareManager = $shareManager; $this->userSession = $userSession; $this->tagManager = $tagManager; $this->userManager = $userManager; + $this->userMountCache = $userMountCache; } public function getName(): string { @@ -140,8 +140,22 @@ public function isLegitimatedForUserId(string $uid): bool { if ($node->getOwner()->getUID() === $uid) { return true; } - $acl = $this->shareManager->getAccessList($node, true, true); - return isset($acl['users']) && array_key_exists($uid, $acl['users']); + + if ($this->eventName === self::EVENT_NAMESPACE . 'postDelete') { + // At postDelete, the file no longer exists. Check for parent folder instead. + $fileId = $node->getParent()->getId(); + } else { + $fileId = $node->getId(); + } + + $mounts = $this->userMountCache->getMountsForFileId($fileId, $uid); + foreach ($mounts as $mount) { + $userFolder = $this->root->getUserFolder($uid); + if (!empty($userFolder->getById($fileId))) { + return true; + } + } + return false; } catch (NotFoundException $e) { return false; } diff --git a/apps/workflowengine/tests/ManagerTest.php b/apps/workflowengine/tests/ManagerTest.php index 543b4550ca6aa..5f92c603e1475 100644 --- a/apps/workflowengine/tests/ManagerTest.php +++ b/apps/workflowengine/tests/ManagerTest.php @@ -26,6 +26,7 @@ */ namespace OCA\WorkflowEngine\Tests; +use OC\Files\Config\UserMountCache; use OC\L10N\L10N; use OCA\WorkflowEngine\Entity\File; use OCA\WorkflowEngine\Helper\ScopeContext; @@ -408,10 +409,10 @@ public function testUpdateOperation() { $this->createMock(IURLGenerator::class), $this->createMock(IRootFolder::class), $this->createMock(ILogger::class), - $this->createMock(\OCP\Share\IManager::class), $this->createMock(IUserSession::class), $this->createMock(ISystemTagManager::class), $this->createMock(IUserManager::class), + $this->createMock(UserMountCache::class), ]) ->setMethodsExcept(['getEvents']) ->getMock(); From 9ed1bbee5c46272282e939855775507961209fe0 Mon Sep 17 00:00:00 2001 From: Jonas Date: Mon, 25 Sep 2023 18:25:53 +0200 Subject: [PATCH 2/2] enh(IMountManager): Add method to get MountPoint from CachedMountInfo Signed-off-by: Jonas --- apps/workflowengine/lib/Entity/File.php | 16 +++++++++++----- apps/workflowengine/tests/ManagerTest.php | 2 ++ lib/private/Files/Config/UserMountCache.php | 2 +- lib/private/Files/Mount/Manager.php | 19 +++++++++++++++++++ 4 files changed, 33 insertions(+), 6 deletions(-) diff --git a/apps/workflowengine/lib/Entity/File.php b/apps/workflowengine/lib/Entity/File.php index b6084266c5d98..7caaaf0e2258a 100644 --- a/apps/workflowengine/lib/Entity/File.php +++ b/apps/workflowengine/lib/Entity/File.php @@ -7,6 +7,7 @@ * * @author Arthur Schiwon * @author Christoph Wurst + * @author Jonas Meurer * * @license GNU AGPL version 3 or any later version * @@ -27,6 +28,7 @@ namespace OCA\WorkflowEngine\Entity; use OC\Files\Config\UserMountCache; +use OC\Files\Mount\Manager as MountManager; use OCP\EventDispatcher\Event; use OCP\EventDispatcher\GenericEvent; use OCP\Files\InvalidPathException; @@ -77,6 +79,8 @@ class File implements IEntity, IDisplayText, IUrl, IIcon, IContextPortation { private $userManager; /** @var UserMountCache */ private $userMountCache; + /** @var MountManager */ + private $mountManager; public function __construct( IL10N $l10n, @@ -86,7 +90,8 @@ public function __construct( IUserSession $userSession, ISystemTagManager $tagManager, IUserManager $userManager, - UserMountCache $userMountCache + UserMountCache $userMountCache, + MountManager $mountManager ) { $this->l10n = $l10n; $this->urlGenerator = $urlGenerator; @@ -96,6 +101,7 @@ public function __construct( $this->tagManager = $tagManager; $this->userManager = $userManager; $this->userMountCache = $userMountCache; + $this->mountManager = $mountManager; } public function getName(): string { @@ -148,10 +154,10 @@ public function isLegitimatedForUserId(string $uid): bool { $fileId = $node->getId(); } - $mounts = $this->userMountCache->getMountsForFileId($fileId, $uid); - foreach ($mounts as $mount) { - $userFolder = $this->root->getUserFolder($uid); - if (!empty($userFolder->getById($fileId))) { + $mountInfos = $this->userMountCache->getMountsForFileId($fileId, $uid); + foreach ($mountInfos as $mountInfo) { + $mount = $this->mountManager->getMountFromMountInfo($mountInfo); + if ($mount && $mount->getStorage() && !empty($mount->getStorage()->getCache()->get($fileId))) { return true; } } diff --git a/apps/workflowengine/tests/ManagerTest.php b/apps/workflowengine/tests/ManagerTest.php index 5f92c603e1475..b708d034df5f4 100644 --- a/apps/workflowengine/tests/ManagerTest.php +++ b/apps/workflowengine/tests/ManagerTest.php @@ -27,6 +27,7 @@ namespace OCA\WorkflowEngine\Tests; use OC\Files\Config\UserMountCache; +use OC\Files\Mount\Manager as MountManager; use OC\L10N\L10N; use OCA\WorkflowEngine\Entity\File; use OCA\WorkflowEngine\Helper\ScopeContext; @@ -413,6 +414,7 @@ public function testUpdateOperation() { $this->createMock(ISystemTagManager::class), $this->createMock(IUserManager::class), $this->createMock(UserMountCache::class), + $this->createMock(MountManager::class), ]) ->setMethodsExcept(['getEvents']) ->getMock(); diff --git a/lib/private/Files/Config/UserMountCache.php b/lib/private/Files/Config/UserMountCache.php index 9838b0a213cf0..8f26dedae22df 100644 --- a/lib/private/Files/Config/UserMountCache.php +++ b/lib/private/Files/Config/UserMountCache.php @@ -463,7 +463,7 @@ public function getMountForPath(IUser $user, string $path): ICachedMountInfo { }, $mounts); $mounts = array_combine($mountPoints, $mounts); - $current = $path; + $current = rtrim($path, '/'); // walk up the directory tree until we find a path that has a mountpoint set // the loop will return if a mountpoint is found or break if none are found while (true) { diff --git a/lib/private/Files/Mount/Manager.php b/lib/private/Files/Mount/Manager.php index 805cce658a678..e623211cc7abe 100644 --- a/lib/private/Files/Mount/Manager.php +++ b/lib/private/Files/Mount/Manager.php @@ -10,6 +10,7 @@ * @author Robin Appelman * @author Robin McCorkell * @author Roeland Jago Douma + * @author Jonas * * @license AGPL-3.0 * @@ -33,6 +34,7 @@ use OC\Files\Filesystem; use OC\Files\SetupManager; use OC\Files\SetupManagerFactory; +use OCP\Files\Config\ICachedMountInfo; use OCP\Files\Mount\IMountManager; use OCP\Files\Mount\IMountPoint; use OCP\Files\NotFoundException; @@ -226,4 +228,21 @@ public function getMountsByMountProvider(string $path, array $mountProviders) { }); } } + + /** + * Return the mount matching a cached mount info (or mount file info) + * + * @param ICachedMountInfo $info + * + * @return IMountPoint|null + */ + public function getMountFromMountInfo(ICachedMountInfo $info): ?IMountPoint { + $this->setupManager->setupForPath($info->getMountPoint()); + foreach ($this->mounts as $mount) { + if ($mount->getMountPoint() === $info->getMountPoint()) { + return $mount; + } + } + return null; + } }