Don't show thumbnails for secureview shares

Co-authored-by: Julian Koberg <jkoberg@owncloud.com>

Signed-off-by: Christian Richter <crichter@owncloud.com>

changelog/unreleased/prevent-thumbnailer-from-showing-secureview-previews.md

@@ -0,0 +1,6 @@
+Bugfix: Don't show thumbnails for secureview shares
+
+We have fixed a bug where thumbnails were shown for secureview shares.
+
+https://github.com/owncloud/ocis/pull/9299
+https://github.com/owncloud/ocis/issues/9249

services/thumbnails/pkg/service/grpc/v0/service.go

@@ -123,6 +123,10 @@ func (g Thumbnail) handleCS3Source(ctx context.Context, req *thumbnailssvc.GetTh
 		return "", err
 	}
 
+	if !sRes.GetInfo().GetPermissionSet().GetInitiateFileDownload() {
+		return "", merrors.Forbidden(g.serviceID, "no download permission")
+	}
+
 	tType := thumbnail.GetExtForMime(sRes.GetInfo().GetMimeType())
 	if tType == "" {
 		tType = req.GetThumbnailType().String()
@@ -206,6 +210,10 @@ func (g Thumbnail) handleWebdavSource(ctx context.Context, req *thumbnailssvc.Ge
 		return "", err
 	}
 
+	if !sRes.GetInfo().GetPermissionSet().GetInitiateFileDownload() {
+		return "", merrors.Forbidden(g.serviceID, "no download permission")
+	}
+
 	tType := thumbnail.GetExtForMime(sRes.GetInfo().GetMimeType())
 	if tType == "" {
 		tType = req.GetThumbnailType().String()

services/webdav/pkg/service/v0/service.go

@@ -261,6 +261,8 @@ func (g Webdav) SpacesThumbnail(w http.ResponseWriter, r *http.Request) {
 			return
 		case http.StatusBadRequest:
 			renderError(w, r, errBadRequest(e.Detail))
+		case http.StatusForbidden:
+			renderError(w, r, errPermissionDenied(e.Detail))
 		default:
 			renderError(w, r, errInternalError(err.Error()))
 		}