Skip to content

Commit d612907

Browse files
salmart-devsalmart-dev
committed
fixup! fix: add support for permissions in operation
Signed-off-by: Salvatore Martire <4652631+salmart-dev@users.noreply.github.com>
1 parent 74d6fa5 commit d612907

4 files changed

Lines changed: 127 additions & 0 deletions

File tree

‎lib/Operation.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,16 @@ public function __construct(
4747
}
4848

4949
/**
50+
* Checks if the user can access the file according to the configured flows.
51+
*
52+
* Flows with `deny` operation always take precedence and make the check fail.
53+
*
54+
* If only flows with permissions match, requiredPermissions is used to decide
55+
* when the check should fail or succeed. If its value is 0, the function simply
56+
* returns the permissions granted by the flows.
57+
*
5058
* @param array|ICacheEntry|null $cacheEntry
59+
* @param int $requiredPermissions Permissions required for the check
5160
* @return int|null If access is not blocked, the permissions allowed by the operations or null if not relevant.
5261
* @throws ForbiddenException
5362
*/

‎lib/StorageWrapper.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ public function __construct($parameters) {
4040
}
4141

4242
/**
43+
* @see Operation::checkFileAccess()
4344
* @throws ForbiddenException
4445
*/
4546
protected function checkFileAccess(string $path, ?bool $isDir = null, ?int $permissions = null): ?int {

‎tests/Integration/features/author.feature‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,19 @@ Feature: Author
1616
Then The webdav response should have a status code "403"
1717
Then User "test1" sees no files in the trashbin
1818

19+
Scenario: Propfind has restrictive permissions when file is blocked
20+
Given User "test1" uploads file "data/textfile.txt" to "/foobar.txt"
21+
And The webdav response should have a status code "201"
22+
And user "admin" creates global flow with 200
23+
| name | Admin flow |
24+
| class | OCA\FilesAccessControl\Operation |
25+
| entity | OCA\WorkflowEngine\Entity\File |
26+
| events | [] |
27+
| operation | deny |
28+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName","operator":"is","value":"foobar.txt"} |
29+
And as user "test1"
30+
Then File "/dir/foobar.txt" should have prop "oc:permissions" equal to "R"
31+
1932
Scenario: Downloading file is blocked
2033
Given User "test1" uploads file "data/textfile.txt" to "/foobar.txt"
2134
And The webdav response should have a status code "201"

‎tests/Integration/features/permissions.feature‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
Feature: Author
2+
Background:
3+
Given user "test1" exists
4+
Given as user "test1"
5+
And using new dav path
6+
7+
Scenario: with UPDATE permissions blocks upload
8+
Given user "admin" creates global flow with 200
9+
| name | Flow with UPDATE permissions |
10+
| class | OCA\FilesAccessControl\Operation |
11+
| entity | OCA\WorkflowEngine\Entity\File |
12+
| events | [] |
13+
| operation | {"permissions": 2} |
14+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
15+
And User "test1" uploads file "data/textfile.txt" to "/foobar.txt"
16+
Then The webdav response should have a status code "403"
17+
Then User "test1" sees no files in the trashbin
18+
19+
Scenario: without UPDATE blocks updating but allows uploading, reading and deleting
20+
Given user "admin" creates global flow with 200
21+
| name | Flow with READ and UPDATE permissions |
22+
| class | OCA\FilesAccessControl\Operation |
23+
| entity | OCA\WorkflowEngine\Entity\File |
24+
| events | [] |
25+
| operation | {"permissions": 5} |
26+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
27+
Given user "admin" creates global flow with 200
28+
| name | Flow with DELETE permissions |
29+
| class | OCA\FilesAccessControl\Operation |
30+
| entity | OCA\WorkflowEngine\Entity\File |
31+
| events | [] |
32+
| operation | {"permissions": 8} |
33+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
34+
And User "test1" uploads file "data/textfile.txt" to "/foobar.txt"
35+
Then The webdav response should have a status code "201"
36+
And User "test1" uploads file "data/textfile-2.txt" to "/foobar.txt"
37+
Then The webdav response should have a status code "403"
38+
And User "test1" deletes file "/foobar.txt"
39+
Then The webdav response should have a status code "204"
40+
When User "test1" loads file list of trashbin
41+
When as user "test1"
42+
And Downloading first trashed file
43+
Then The webdav response should have a status code "200"
44+
45+
Scenario: masked permissions are returned
46+
Given user "admin" creates global flow with 200
47+
| name | Flow with READ and UPDATE permissions |
48+
| class | OCA\FilesAccessControl\Operation |
49+
| entity | OCA\WorkflowEngine\Entity\File |
50+
| events | [] |
51+
| operation | {"permissions": 5} |
52+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
53+
Given user "admin" creates global flow with 200
54+
| name | Flow with DELETE permissions |
55+
| class | OCA\FilesAccessControl\Operation |
56+
| entity | OCA\WorkflowEngine\Entity\File |
57+
| events | [] |
58+
| operation | {"permissions": 8} |
59+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
60+
And User "test1" uploads file "data/textfile.txt" to "/foobar.txt"
61+
Then The webdav response should have a status code "201"
62+
When as user "test1"
63+
Then File "/foobar.txt" should have prop "oc:permissions" equal to "GDN"
64+
65+
@only
66+
Scenario: no permissions should block file
67+
And User "test1" uploads file "data/textfile.txt" to "/foobar.txt"
68+
Then The webdav response should have a status code "201"
69+
When user "admin" creates global flow with 200
70+
| name | Flow with READ and UPDATE permissions |
71+
| class | OCA\FilesAccessControl\Operation |
72+
| entity | OCA\WorkflowEngine\Entity\File |
73+
| events | [] |
74+
| operation | {"permissions": 0} |
75+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
76+
When as user "test1"
77+
Then File "/foobar.txt" should have prop "oc:permissions" equal to "R"
78+
79+
Scenario: deny operation override permissions from other operations
80+
Given User "test1" deletes folder "/dir"
81+
Given User "test1" created a folder "/dir"
82+
Then The webdav response should have a status code "201"
83+
When User "test1" uploads file "data/textfile.txt" to "/dir/foobar.txt"
84+
Then The webdav response should have a status code "201"
85+
Given user "admin" creates global flow with 200
86+
| name | Flow with READ and UPDATE permissions |
87+
| class | OCA\FilesAccessControl\Operation |
88+
| entity | OCA\WorkflowEngine\Entity\File |
89+
| events | [] |
90+
| operation | {"permissions": 5} |
91+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
92+
Given user "admin" creates global flow with 200
93+
| name | Flow with DELETE permissions |
94+
| class | OCA\FilesAccessControl\Operation |
95+
| entity | OCA\WorkflowEngine\Entity\File |
96+
| events | [] |
97+
| operation | deny |
98+
| checks-0 | {"class":"OCA\\\\WorkflowEngine\\\\Check\\\\FileName", "operator": "is", "value": "foobar.txt"} |
99+
When as user "test1"
100+
Then File "/dir/foobar.txt" should have prop "oc:permissions" equal to "R"
101+
And user "test1" should see following elements
102+
| /dir/foobar.txt |
103+
When Downloading file "/dir/foobar.txt"
104+
Then The webdav response should have a status code "404"

0 commit comments

Comments
 (0)