Skip to content

fix(sharing): require read permission to load files from public shares - #355

Open
solracsf wants to merge 1 commit into
mainfrom
fix/public-load-read-permission
Open

solracsf wants to merge 1 commit into
mainfrom
fix/public-load-read-permission

Conversation

@solracsf

Copy link
Copy Markdown
Member

Loading a file through the public share endpoint now checks that the share has read permission, and returns a 403 when it doesn't.

This also adds a small PHPUnit setup for the app. It runs from inside a server checkout (apps/files_mindmap/tests), like other Nextcloud apps do. It isn't wired into CI yet.

Tested locally on PHP 8.2 against stable33 and stable34, each with MariaDB 11.8 and PostgreSQL 16:

  • The new test fails without the change and passes with it.
  • Manual check that read-only folder shares still open mind maps, on NC 33 with local storage and NC 34 with S3 primary storage.

Adds a PHPUnit setup for the app, run from within a server checkout.

Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant