update reva to latest edge

changelog/unreleased/bump-reva.md

@@ -2,6 +2,7 @@ Enhancement: Bump Reva
 
 bumps reva version
 
+https://github.com/owncloud/ocis/pull/7540
 https://github.com/owncloud/ocis/pull/7526
 https://github.com/owncloud/ocis/pull/7138
 https://github.com/owncloud/ocis/pull/6427

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.7.0
 	github.com/cs3org/go-cs3apis v0.0.0-20230727093620-0f4399be4543
-	github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18
+	github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79
 	github.com/disintegration/imaging v1.6.2
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
 	github.com/egirna/icap-client v0.1.1

go.sum

@@ -1015,6 +1015,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
 github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
 github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 h1:RP4vT83ghliBeJICDid1CNfbfssFJE+D6eXTPOkxhjk=
 github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA=
+github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 h1:c6rk7hzCq+9lvOtWKPH6DbGnCHvNQosW2H8YQaslneU=
+github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=

vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go

@@ -19,11 +19,13 @@
 package shares
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"strconv"
 
+	userv1beta1 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	permissionsv1beta1 "github.com/cs3org/go-cs3apis/cs3/permissions/v1beta1"
 	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	link "github.com/cs3org/go-cs3apis/cs3/sharing/link/v1beta1"
@@ -360,7 +362,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 			return
 		}
 
-		if !sRes.Info.PermissionSet.UpdateGrant {
+		if sRes.Info == nil || !sRes.Info.GetPermissionSet().UpdateGrant {
 			response.WriteOCSError(w, r, response.MetaUnauthorized.StatusCode, "missing permissions to update share", err)
 			return
 		}
@@ -469,10 +471,16 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 	newPassword, ok := r.Form["password"]
 	// enforcePassword
 	if h.enforcePassword(permKey) {
-		if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 {
-			response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", err)
+		p, err := conversions.NewPermissions(decreasePermissionsIfNecessary(*permKey))
+		if err != nil {
+			response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check permissions from request", err)
 			return
 		}
+		if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 {
+			if h.checkPasswordEnforcement(ctx, user, p, w, r) != nil {
+				return
+			}
+		}
 	}
 
 	// update or clear password
@@ -687,6 +695,41 @@ func permKeyFromRequest(r *http.Request, h *Handler) (*int, error) {
 	return &permKey, nil
 }
 
+// checkPasswordEnforcement checks if the password needs to be set for a link
+// some users can opt out of the enforcement based on a user permission
+func (h *Handler) checkPasswordEnforcement(ctx context.Context, user *userv1beta1.User, perm conversions.Permissions, w http.ResponseWriter, r *http.Request) error {
+	// Non-read-only links
+	if perm != conversions.PermissionRead {
+		response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", nil)
+		return errors.New("missing required password")
+	}
+	// Check if the user is allowed to opt out of the password enforcement
+	// for read-only links
+	gwC, err := h.getClient()
+	if err != nil {
+		response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "could not check permission", err)
+		return errors.New("could not check permission")
+	}
+	resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{
+		SubjectRef: &permissionsv1beta1.SubjectReference{
+			Spec: &permissionsv1beta1.SubjectReference_UserId{
+				UserId: user.Id,
+			},
+		},
+		Permission: "ReadOnlyPublicLinkPassword.Delete",
+	})
+	if err != nil {
+		response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err)
+		return errors.New("failed to check user permission")
+	}
+
+	if resp.Status.Code != rpc.Code_CODE_OK {
+		response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to delete the password from the public link", nil)
+		return errors.New("user is not allowed to delete the password from the public link")
+	}
+	return nil
+}
+
 // TODO: add mapping for user share permissions to role
 
 // Maps oc10 public link permissions to roles

vendor/modules.txt

@@ -357,7 +357,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18
+# github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79
 ## explicit; go 1.20
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime