feat: allow users with "native" access to make some changes to shares

Signed-off-by: Robin Appelman <robin@icewind.nl>

Author: icewind1991

lib/private/Sharing/SharingBackend.php

@@ -603,6 +603,7 @@ private function list(
 		} else {
 			$filterSourceType = null;
 		}
+
 		/** @var array<class-string<IShareRecipientType>, list<string>> $recipientTypeValues */
 		$recipientTypeValues = [];
 
@@ -896,9 +897,11 @@ private function list(
 				if ($share['owner']->isCurrentUser($accessContext)) {
 					continue;
 				}
+
 				if ($userHasDirectAccess) {
 					continue;
 				}
+
 				$isAnyMatchingRecipient = false;
 				foreach ($share['recipients'] as &$recipient) {
 					$isMatchingRecipient = false;

lib/private/Sharing/SharingManager.php

@@ -190,7 +190,7 @@ public function updateShareState(ShareAccessContext $accessContext, Share $share
 		$time = $this->getTime();
 		$this->backend->setLastUpdated([$share->id], $time);
 
-		$this->validateShareOwnerOperation($accessContext, $share->owner);
+		$this->validateShareEditPermissions($accessContext, $share);
 
 		if ($state === ShareState::Active) {
 			$this->assertShareCanBeActive($share);
@@ -217,7 +217,8 @@ public function updateShareState(ShareAccessContext $accessContext, Share $share
 	public function addShareSource(ShareAccessContext $accessContext, Share $share, ShareSource $source): Share {
 		$this->assertInTransaction();
 
-		$this->validateShareOwnerOperation($accessContext, $share->owner);
+		// only the owner can add sources, otherwise a user could add sources others don't have access to, which would remove their access
+		$this->validateShareEditPermissions($accessContext, $share, true);
 
 		if (($sourceType = $this->registry->getSourceTypes()[$source->class] ?? null) === null) {
 			throw new RuntimeException('The source type is not registered: ' . $source->class);
@@ -260,7 +261,8 @@ public function addShareSource(ShareAccessContext $accessContext, Share $share,
 	public function removeShareSource(ShareAccessContext $accessContext, Share $share, ShareSource $source): Share {
 		$this->assertInTransaction();
 
-		$this->validateShareOwnerOperation($accessContext, $share->owner);
+		// only the owner can remove sources, to mirror the "add source" permissions
+		$this->validateShareEditPermissions($accessContext, $share, true);
 
 		$time = $this->getTime();
 		$this->backend->setLastUpdated([$share->id], $time);
@@ -321,7 +323,7 @@ public function addShareRecipient(ShareAccessContext $accessContext, Share $shar
 		$this->assertInTransaction();
 
 		try {
-			$this->validateShareOwnerOperation($accessContext, $share->owner);
+			$this->validateShareEditPermissions($accessContext, $share);
 		} catch (ShareOperationForbiddenException) {
 			$this->validatePermission($share, ReshareSharePermissionType::class);
 		}
@@ -398,7 +400,7 @@ public function removeShareRecipient(ShareAccessContext $accessContext, Share $s
 		$this->assertInTransaction();
 
 		try {
-			$this->validateShareOwnerOperation($accessContext, $share->owner);
+			$this->validateShareEditPermissions($accessContext, $share);
 		} catch (ShareOperationForbiddenException) {
 			// This does not allow removing own recipients. A user can only reject a share, but not remove it for the recipient.
 			$this->validateReshareOperation($accessContext, $share, $recipient);
@@ -484,7 +486,7 @@ public function updateShareRecipientSecret(ShareAccessContext $accessContext, Sh
 		$this->assertInTransaction();
 
 		try {
-			$this->validateShareOwnerOperation($accessContext, $share->owner);
+			$this->validateShareEditPermissions($accessContext, $share);
 		} catch (ShareOperationForbiddenException) {
 			$this->validateReshareOperation($accessContext, $share, $recipient);
 		}
@@ -540,7 +542,7 @@ public function updateShareRecipientSecret(ShareAccessContext $accessContext, Sh
 	public function updateShareProperty(ShareAccessContext $accessContext, Share $share, ShareProperty $property): Share {
 		$this->assertInTransaction();
 
-		$this->validateShareOwnerOperation($accessContext, $share->owner);
+		$this->validateShareEditPermissions($accessContext, $share);
 
 		if (($propertyType = $this->registry->getPropertyTypes()[$property->class] ?? null) === null) {
 			throw new RuntimeException('The property is not registered: ' . $property->class);
@@ -577,7 +579,7 @@ public function updateShareProperty(ShareAccessContext $accessContext, Share $sh
 	public function updateSharePermission(ShareAccessContext $accessContext, Share $share, SharePermission $permission): Share {
 		$this->assertInTransaction();
 
-		$this->validateShareOwnerOperation($accessContext, $share->owner);
+		$this->validateShareEditPermissions($accessContext, $share);
 
 		if (!isset($this->registry->getPermissionTypes()[$permission->class])) {
 			throw new RuntimeException('The permission type is not registered: ' . $permission->class);
@@ -614,7 +616,7 @@ public function updateSharePermission(ShareAccessContext $accessContext, Share $
 	public function selectSharePermissionPreset(ShareAccessContext $accessContext, Share $share, string $permissionPresetClass): Share {
 		$this->assertInTransaction();
 
-		$this->validateShareOwnerOperation($accessContext, $share->owner);
+		$this->validateShareEditPermissions($accessContext, $share);
 
 		if (($this->registry->getPermissionPresetCompatiblePermissionTypeClasses()[$permissionPresetClass] ?? null) === null) {
 			throw new RuntimeException('The permission preset is not registered: ' . $permissionPresetClass);
@@ -654,7 +656,7 @@ public function deleteShare(ShareAccessContext $accessContext, Share $share): vo
 
 		// No need to update the last updated timestamp, because the share will be deleted anyway.
 
-		$this->validateShareOwnerOperation($accessContext, $share->owner);
+		$this->validateShareEditPermissions($accessContext, $share);
 
 		$this->backend->deleteShare($share->id);
 
@@ -710,19 +712,36 @@ private function assertInTransaction(): void {
 		}
 	}
 
-	// TODO: Support IShareOwnerlessMount
-
 	/**
 	 * @throws ShareOperationForbiddenException
 	 */
-	private function validateShareOwnerOperation(ShareAccessContext $accessContext, ShareUser $owner): void {
+	private function validateShareEditPermissions(ShareAccessContext $accessContext, Share $share, bool $onlyOwner = false): void {
 		if ($accessContext->overrideChecks) {
 			return;
 		}
 
-		if ($owner->instance !== null || !$accessContext->currentUser instanceof IUser || $owner->userId !== $accessContext->currentUser->getUID()) {
+		if ($share->owner->instance !== null || !$accessContext->currentUser instanceof IUser) {
+			throw new ShareOperationForbiddenException();
+		}
+
+		if ($share->owner->userId === $accessContext->currentUser->getUID()) {
+			return;
+		}
+
+		if ($onlyOwner) {
 			throw new ShareOperationForbiddenException();
 		}
+
+		foreach ($share->sources as $source) {
+			$sourceType = $this->registry->getSourceTypes()[$source->class] ?? null;
+			if (!$sourceType) {
+				throw new ShareOperationForbiddenException();
+			}
+
+			if (!$sourceType->userHasDirectSharingAccessToSource($accessContext->currentUser, $source->value)) {
+				throw new ShareOperationForbiddenException();
+			}
+		}
 	}
 
 	/**