From b6e62b3d795ee74d0123faf4edcb8bc28680f208 Mon Sep 17 00:00:00 2001 From: Michael Barz Date: Mon, 23 Oct 2023 14:51:59 +0200 Subject: [PATCH] update reva to latest edge --- changelog/unreleased/bump-reva.md | 1 + go.mod | 2 +- go.sum | 2 + .../handlers/apps/sharing/shares/public.go | 49 +++++++++++++++++-- vendor/modules.txt | 2 +- 5 files changed, 51 insertions(+), 5 deletions(-) diff --git a/changelog/unreleased/bump-reva.md b/changelog/unreleased/bump-reva.md index 84da193368..2b4e213406 100644 --- a/changelog/unreleased/bump-reva.md +++ b/changelog/unreleased/bump-reva.md @@ -2,6 +2,7 @@ Enhancement: Bump Reva bumps reva version +https://github.com/owncloud/ocis/pull/7540 https://github.com/owncloud/ocis/pull/7526 https://github.com/owncloud/ocis/pull/7138 https://github.com/owncloud/ocis/pull/6427 diff --git a/go.mod b/go.mod index 54724081de..256b0da810 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/coreos/go-oidc v2.2.1+incompatible github.com/coreos/go-oidc/v3 v3.7.0 github.com/cs3org/go-cs3apis v0.0.0-20230727093620-0f4399be4543 - github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 + github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 github.com/disintegration/imaging v1.6.2 github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e github.com/egirna/icap-client v0.1.1 diff --git a/go.sum b/go.sum index 142e6ed2b1..5a55014618 100644 --- a/go.sum +++ b/go.sum @@ -1015,6 +1015,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c= github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME= github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 h1:RP4vT83ghliBeJICDid1CNfbfssFJE+D6eXTPOkxhjk= github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA= +github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 h1:c6rk7hzCq+9lvOtWKPH6DbGnCHvNQosW2H8YQaslneU= +github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA= github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go index b0487216bb..36d038ee8e 100644 --- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go +++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go @@ -19,11 +19,13 @@ package shares import ( + "context" "encoding/json" "fmt" "net/http" "strconv" + userv1beta1 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" permissionsv1beta1 "github.com/cs3org/go-cs3apis/cs3/permissions/v1beta1" rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1" link "github.com/cs3org/go-cs3apis/cs3/sharing/link/v1beta1" @@ -360,7 +362,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar return } - if !sRes.Info.PermissionSet.UpdateGrant { + if sRes.Info == nil || !sRes.Info.GetPermissionSet().UpdateGrant { response.WriteOCSError(w, r, response.MetaUnauthorized.StatusCode, "missing permissions to update share", err) return } @@ -469,10 +471,16 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar newPassword, ok := r.Form["password"] // enforcePassword if h.enforcePassword(permKey) { - if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 { - response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", err) + p, err := conversions.NewPermissions(decreasePermissionsIfNecessary(*permKey)) + if err != nil { + response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check permissions from request", err) return } + if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 { + if h.checkPasswordEnforcement(ctx, user, p, w, r) != nil { + return + } + } } // update or clear password @@ -687,6 +695,41 @@ func permKeyFromRequest(r *http.Request, h *Handler) (*int, error) { return &permKey, nil } +// checkPasswordEnforcement checks if the password needs to be set for a link +// some users can opt out of the enforcement based on a user permission +func (h *Handler) checkPasswordEnforcement(ctx context.Context, user *userv1beta1.User, perm conversions.Permissions, w http.ResponseWriter, r *http.Request) error { + // Non-read-only links + if perm != conversions.PermissionRead { + response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", nil) + return errors.New("missing required password") + } + // Check if the user is allowed to opt out of the password enforcement + // for read-only links + gwC, err := h.getClient() + if err != nil { + response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "could not check permission", err) + return errors.New("could not check permission") + } + resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{ + SubjectRef: &permissionsv1beta1.SubjectReference{ + Spec: &permissionsv1beta1.SubjectReference_UserId{ + UserId: user.Id, + }, + }, + Permission: "ReadOnlyPublicLinkPassword.Delete", + }) + if err != nil { + response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err) + return errors.New("failed to check user permission") + } + + if resp.Status.Code != rpc.Code_CODE_OK { + response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to delete the password from the public link", nil) + return errors.New("user is not allowed to delete the password from the public link") + } + return nil +} + // TODO: add mapping for user share permissions to role // Maps oc10 public link permissions to roles diff --git a/vendor/modules.txt b/vendor/modules.txt index e0051c7cca..cfa2273f7b 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -357,7 +357,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1 github.com/cs3org/go-cs3apis/cs3/types/v1beta1 -# github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 +# github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 ## explicit; go 1.20 github.com/cs3org/reva/v2/cmd/revad/internal/grace github.com/cs3org/reva/v2/cmd/revad/runtime