Merge pull request #62729 from nextcloud/backport/62724/stable30

[stable30] fix(share-api-controller): add sanity check on canAccessShare for circle share types

Author: AndyScherzinger

apps/files_sharing/lib/Controller/ShareAPIController.php

@@ -1510,8 +1510,29 @@ protected function canAccessShare(\OCP\Share\IShare $share, bool $checkGroups =
 		}
 
 		if ($share->getShareType() === IShare::TYPE_CIRCLE) {
-			// TODO: have a sanity check like above?
-			return true;
+			if (
+				Server::get(IAppManager::class)->isEnabledForUser('circles')
+				&& class_exists('\OCA\Circles\Api\v1\Circles')
+			) {
+				$hasCircleId = (str_ends_with($share->getSharedWith(), ']'));
+				$shareWithStart = ($hasCircleId ? strrpos($share->getSharedWith(), '[') + 1 : 0);
+				$shareWithLength = ($hasCircleId ? -1 : strpos($share->getSharedWith(), ' '));
+				if ($shareWithLength === false) {
+					$sharedWith = substr($share->getSharedWith(), $shareWithStart);
+				} else {
+					$sharedWith = substr($share->getSharedWith(), $shareWithStart, $shareWithLength);
+				}
+				try {
+					$member = Circles::getMember($sharedWith, $this->userId, 1);
+					if ($member->getLevel() >= 1) {
+						return true;
+					}
+					return false;
+				} catch (\Exception $e) {
+					return false;
+				}
+			}
+			return false;
 		}
 
 		if ($share->getShareType() === IShare::TYPE_ROOM) {

build/psalm-baseline.xml

@@ -886,6 +886,7 @@
     <UndefinedClass>
       <code><![CDATA[\OCA\Circles\Api\v1\Circles]]></code>
       <code><![CDATA[\OCA\Circles\Api\v1\Circles]]></code>
+      <code><![CDATA[\OCA\Circles\Api\v1\Circles]]></code>
     </UndefinedClass>
     <UndefinedDocblockClass>
       <code><![CDATA[$this->getRoomShareHelper()]]></code>