Prevent sharing share_folder

VicDeo · VicDeo · commit b0aaeb298d94 · 2019-10-21T11:57:30.000+03:00
diff --git a/changelog/unreleased/36297 b/changelog/unreleased/36297
@@ -0,0 +1,6 @@
+Bugfix: Fix possibility of sharing for the share_folder by resetting share permission for it
+
+share_folder had share permission so it was possible for the user to share all received shares. 
+
+https://github.com/owncloud/core/issues/36241
+https://github.com/owncloud/core/pull/36297
diff --git a/lib/private/Files/View.php b/lib/private/Files/View.php
@@ -1503,8 +1503,11 @@ public function getDirectoryContent($directory, $mimetype_filter = '') {
 			$files = \array_filter($contents, function (ICacheEntry $content) {
 				return (!\OC\Files\Filesystem::isForbiddenFileOrDir($content['path']));
 			});
-			$files = \array_map(function (ICacheEntry $content) use ($path, $storage, $mount, $sharingDisabled) {
-				if ($sharingDisabled) {
+
+			$shareFolder = \trim($this->config->getSystemValue('share_folder', '/'), '/');
+			$files = \array_map(function (ICacheEntry $content) use ($path, $storage, $mount, $sharingDisabled, $shareFolder) {
+				$isShareFolder = $content['path'] === "files/$shareFolder";
+				if ($sharingDisabled || $isShareFolder) {
 					$content['permissions'] = $content['permissions'] & ~\OCP\Constants::PERMISSION_SHARE;
 				}
 				$owner = $this->getUserObjectForOwner($storage->getOwner($content['path']));
diff --git a/tests/acceptance/features/apiShareManagementBasic/createShare.feature b/tests/acceptance/features/apiShareManagementBasic/createShare.feature
@@ -1440,3 +1440,14 @@ Feature: sharing
       | /randomfile.txt |
     And the content of file "randomfile.txt" for user "user2" should be "user0 file"
     And the content of file "randomfile.txt" for user "user1" should be "user0 file"
+
+  Scenario Outline: Do not allow sharing of the entire share_folder
+    Given using OCS API version "<ocs_api_version>"
+    And the administrator has set the default folder for received shares to "<share_folder>"
+    When user "user0" shares folder "/ReceivedShares" with user "user1" using the sharing API
+    Then the OCS status code should be "<ocs_status_code>"
+    And the HTTP status code should be "<http_status_code>"
+    Examples:
+      | ocs_api_version | ocs_status_code | http_status_code | share_folder    |
+      | 1               | 403             | 200              | /ReceivedShares |
+      | 2               | 403             | 403              | /ReceivedShares |
