Merge pull request #9070 from nextcloud/backport/8879/stable29

[stable29] fix(share): detect if documentId is outside of share early

Author: max-nextcloud

lib/Middleware/SessionMiddleware.php

@@ -17,6 +17,8 @@
 use OCP\AppFramework\Http\Response;
 use OCP\AppFramework\Middleware;
 use OCP\Constants;
+use OCP\Files\File;
+use OCP\Files\Folder;
 use OCP\Files\IRootFolder;
 use OCP\Files\NotPermittedException;
 use OCP\IL10N;
@@ -131,6 +133,17 @@ private function assertUserOrShareToken(ISessionAwareController $controller): vo
 				throw new InvalidSessionException();
 			}
 
+			if ($share->getNodeType() === 'folder') {
+				$folder = $share->getNode();
+				if (!$folder instanceof Folder) {
+					throw new InvalidSessionException();
+				}
+				$file = $folder->getFirstNodeById($documentId);
+				if (!$file instanceof File) {
+					throw new InvalidSessionException();
+				}
+			}
+
 			if ($share->getPassword() !== null) {
 				$shareIds = $this->session->get('public_link_authenticated');
 				$shareIds = is_array($shareIds) ? $shareIds : [$shareIds];