|
|
|
@ -24,22 +24,24 @@ namespace OCA\DAV\DAV;
|
|
|
|
|
use OCA\DAV\Connector\Sabre\Exception\Forbidden;
|
|
|
|
|
use OCA\DAV\Connector\Sabre\File as DavFile;
|
|
|
|
|
use OCA\Files_Versions\Sabre\VersionFile;
|
|
|
|
|
use OCP\Files\Folder;
|
|
|
|
|
use OCP\Files\NotFoundException;
|
|
|
|
|
use Psr\Log\LoggerInterface;
|
|
|
|
|
use Sabre\DAV\Exception\NotFound;
|
|
|
|
|
use Sabre\DAV\Server;
|
|
|
|
|
use Sabre\DAV\ServerPlugin;
|
|
|
|
|
use Sabre\HTTP\RequestInterface;
|
|
|
|
|
use Sabre\DAV\Exception\NotFound;
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Sabre plugin for restricting file share receiver download:
|
|
|
|
|
*/
|
|
|
|
|
class ViewOnlyPlugin extends ServerPlugin {
|
|
|
|
|
private ?Server $server = null;
|
|
|
|
|
private LoggerInterface $logger;
|
|
|
|
|
private ?Folder $userFolder;
|
|
|
|
|
|
|
|
|
|
public function __construct(LoggerInterface $logger) {
|
|
|
|
|
$this->logger = $logger;
|
|
|
|
|
public function __construct(
|
|
|
|
|
?Folder $userFolder
|
|
|
|
|
) {
|
|
|
|
|
$this->userFolder = $userFolder;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
@ -74,8 +76,18 @@ class ViewOnlyPlugin extends ServerPlugin {
|
|
|
|
|
if ($davNode instanceof DavFile) {
|
|
|
|
|
// Restrict view-only to nodes which are shared
|
|
|
|
|
$node = $davNode->getNode();
|
|
|
|
|
} else if ($davNode instanceof VersionFile) {
|
|
|
|
|
} elseif ($davNode instanceof VersionFile) {
|
|
|
|
|
$node = $davNode->getVersion()->getSourceFile();
|
|
|
|
|
$currentUserId = $this->userFolder->getOwner()->getUID();
|
|
|
|
|
// The version source file is relative to the owner storage.
|
|
|
|
|
// But we need the node from the current user perspective.
|
|
|
|
|
if ($node->getOwner()->getUID() !== $currentUserId) {
|
|
|
|
|
$nodes = $this->userFolder->getById($node->getId());
|
|
|
|
|
$node = array_pop($nodes);
|
|
|
|
|
if (!$node) {
|
|
|
|
|
throw new NotFoundException("Version file not accessible by current user");
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|