From b9db1c270c2b395f7c927d2597edca07c8fff760 Mon Sep 17 00:00:00 2001 From: jkoberg Date: Fri, 28 Apr 2023 11:34:17 +0200 Subject: [PATCH] bump reva Signed-off-by: jkoberg --- changelog/unreleased/bump-reva.md | 5 + go.mod | 2 +- go.sum | 4 +- .../handlers/apps/sharing/shares/public.go | 143 ++++++++++-------- vendor/modules.txt | 2 +- 5 files changed, 92 insertions(+), 64 deletions(-) create mode 100644 changelog/unreleased/bump-reva.md diff --git a/changelog/unreleased/bump-reva.md b/changelog/unreleased/bump-reva.md new file mode 100644 index 0000000000..efc0ad879b --- /dev/null +++ b/changelog/unreleased/bump-reva.md @@ -0,0 +1,5 @@ +Enhancement: Bump Reva Version + +Bumps the reva version + +https://github.com/owncloud/ocis/pull/6186 diff --git a/go.mod b/go.mod index ac51b435f9..95521aa7f9 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/coreos/go-oidc v2.2.1+incompatible github.com/coreos/go-oidc/v3 v3.4.0 github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965 - github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5 + github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df github.com/disintegration/imaging v1.6.2 github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e github.com/egirna/icap-client v0.1.1 diff --git a/go.sum b/go.sum index d005bd0df0..8fcd68e44a 100644 --- a/go.sum +++ b/go.sum @@ -627,8 +627,8 @@ github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4= github.com/crewjam/saml v0.4.13 h1:TYHggH/hwP7eArqiXSJUvtOPNzQDyQ7vwmwEqlFWhMc= github.com/crewjam/saml v0.4.13/go.mod h1:igEejV+fihTIlHXYP8zOec3V5A8y3lws5bQBFsTm4gA= -github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5 h1:wloX5LiqRxwh2ID9O+em8O5VU1h2ZN5u6tPceAdLNDI= -github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5/go.mod h1:VxBmpOvIKlgKLPOsHun+fABopzX+3ZELPAp3N5bQMsM= +github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df h1:3fcCvjkxk6RcAKMWjxzvSsLFIsgEr1REYAXBE8HGNOs= +github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df/go.mod h1:VxBmpOvIKlgKLPOsHun+fABopzX+3ZELPAp3N5bQMsM= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY= github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4= diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go index 87d460ade7..4a1d8f88ad 100644 --- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go +++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go @@ -40,6 +40,8 @@ import ( "github.com/pkg/errors" ) +var _defaultPublicLinkPermission = 1 + func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request, statInfo *provider.ResourceInfo) (*link.PublicShare, *ocsError) { ctx := r.Context() log := appctx.GetLogger(ctx) @@ -53,27 +55,39 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request, } } - user := ctxpkg.ContextMustGetUser(ctx) - resp, err := c.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{ - SubjectRef: &permissionsv1beta1.SubjectReference{ - Spec: &permissionsv1beta1.SubjectReference_UserId{ - UserId: user.Id, - }, - }, - Permission: "PublicLink.Write", - }) + permKey, err := permKeyFromRequest(r, h) if err != nil { return nil, &ocsError{ - Code: response.MetaServerError.StatusCode, - Message: "failed to check user permission", + Code: response.MetaBadRequest.StatusCode, + Message: "Could not read permission from request", Error: err, } } - if resp.Status.Code != rpc.Code_CODE_OK { - return nil, &ocsError{ - Code: response.MetaForbidden.StatusCode, - Message: "user is not allowed to create a public link", + // NOTE: one is allowed to create an internal link without the `Publink.Write` permission + if permKey != nil && *permKey != 0 { + user := ctxpkg.ContextMustGetUser(ctx) + resp, err := c.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{ + SubjectRef: &permissionsv1beta1.SubjectReference{ + Spec: &permissionsv1beta1.SubjectReference_UserId{ + UserId: user.Id, + }, + }, + Permission: "PublicLink.Write", + }) + if err != nil { + return nil, &ocsError{ + Code: response.MetaServerError.StatusCode, + Message: "failed to check user permission", + Error: err, + } + } + + if resp.Status.Code != rpc.Code_CODE_OK { + return nil, &ocsError{ + Code: response.MetaForbidden.StatusCode, + Message: "user is not allowed to create a public link", + } } } @@ -113,19 +127,18 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request, } } - newPermissions, err := permissionFromRequest(r, h) + permissions, err := ocPublicPermToCs3(permKey, h) if err != nil { return nil, &ocsError{ Code: response.MetaBadRequest.StatusCode, - Message: "Could not read permission from request", + Message: "Could not create permission from permission key", Error: err, } } - - if newPermissions == nil { + if permissions == nil { // default perms: read-only // TODO: the default might change depending on allowed permissions and configs - newPermissions, err = ocPublicPermToCs3(1, h) + permissions, err = ocPublicPermToCs3(&_defaultPublicLinkPermission, h) if err != nil { return nil, &ocsError{ Code: response.MetaServerError.StatusCode, @@ -137,14 +150,14 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request, if statInfo != nil && statInfo.Type == provider.ResourceType_RESOURCE_TYPE_FILE { // Single file shares should never have delete or create permissions - role := conversions.RoleFromResourcePermissions(newPermissions, true) - permissions := role.OCSPermissions() - permissions &^= conversions.PermissionCreate - permissions &^= conversions.PermissionDelete - newPermissions = conversions.RoleFromOCSPermissions(permissions).CS3ResourcePermissions() + role := conversions.RoleFromResourcePermissions(permissions, true) + p := role.OCSPermissions() + p &^= conversions.PermissionCreate + p &^= conversions.PermissionDelete + permissions = conversions.RoleFromOCSPermissions(p).CS3ResourcePermissions() } - if !sufficientPermissions(statInfo.PermissionSet, newPermissions, true) { + if !sufficientPermissions(statInfo.PermissionSet, permissions, true) { response.WriteOCSError(w, r, http.StatusNotFound, "no share permission", nil) return nil, &ocsError{ Code: http.StatusNotFound, @@ -157,7 +170,7 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request, ResourceInfo: statInfo, Grant: &link.Grant{ Permissions: &link.PublicSharePermissions{ - Permissions: newPermissions, + Permissions: permissions, }, Password: r.FormValue("password"), }, @@ -296,23 +309,11 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar } ctx := r.Context() - user := ctxpkg.ContextMustGetUser(ctx) - resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{ - SubjectRef: &permissionsv1beta1.SubjectReference{ - Spec: &permissionsv1beta1.SubjectReference_UserId{ - UserId: user.Id, - }, - }, - Permission: "PublicLink.Write", - }) - if err != nil { - response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err) - return - } - if resp.Status.Code != rpc.Code_CODE_OK { - response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to create a public link", nil) + permKey, err := permKeyFromRequest(r, h) + if err != nil { + response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "invalid permissions", err) return } @@ -330,8 +331,30 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar return } - u := ctxpkg.ContextMustGetUser(r.Context()) - if !publicshare.IsCreatedByUser(*before.Share, u) { + createdByUser := publicshare.IsCreatedByUser(*before.Share, user) + + // NOTE: you are allowed to update a link TO a public link without the `PublicLink.Write` permission if you created it yourself + if (permKey != nil && *permKey != 0) || !createdByUser { + resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{ + SubjectRef: &permissionsv1beta1.SubjectReference{ + Spec: &permissionsv1beta1.SubjectReference_UserId{ + UserId: user.Id, + }, + }, + Permission: "PublicLink.Write", + }) + if err != nil { + response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err) + return + } + + if resp.Status.Code != rpc.Code_CODE_OK { + response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to update the public link", nil) + return + } + } + + if !createdByUser { sRes, err := gwC.Stat(r.Context(), &provider.StatRequest{Ref: &provider.Reference{ResourceId: before.Share.ResourceId}}) if err != nil { log.Err(err).Interface("resource_id", before.Share.ResourceId).Msg("failed to stat shared resource") @@ -368,7 +391,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar } // Permissions - newPermissions, err := permissionFromRequest(r, h) + newPermissions, err := ocPublicPermToCs3(permKey, h) logger.Debug().Interface("newPermissions", newPermissions).Msg("Parsed permissions") if err != nil { response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "invalid permissions", err) @@ -563,9 +586,12 @@ func decreasePermissionsIfNecessary(perm int) int { return perm } -func ocPublicPermToCs3(permKey int, h *Handler) (*provider.ResourcePermissions, error) { +func ocPublicPermToCs3(pk *int, h *Handler) (*provider.ResourcePermissions, error) { + if pk == nil { + return nil, nil + } - permKey = decreasePermissionsIfNecessary(permKey) + permKey := decreasePermissionsIfNecessary(*pk) // TODO refactor this ocPublicPermToRole[permKey] check into a conversions.NewPublicSharePermissions? // not all permissions are possible for public shares @@ -583,7 +609,8 @@ func ocPublicPermToCs3(permKey int, h *Handler) (*provider.ResourcePermissions, return conversions.RoleFromOCSPermissions(perm).CS3ResourcePermissions(), nil } -func permissionFromRequest(r *http.Request, h *Handler) (*provider.ResourcePermissions, error) { +// pointer will be nil if no permission is set +func permKeyFromRequest(r *http.Request, h *Handler) (*int, error) { var err error // phoenix sends: {"permissions": 15}. See ocPublicPermToRole struct for mapping @@ -593,11 +620,11 @@ func permissionFromRequest(r *http.Request, h *Handler) (*provider.ResourcePermi // handle legacy "publicUpload" arg that overrides permissions differently depending on the scenario // https://github.com/owncloud/core/blob/v10.4.0/apps/files_sharing/lib/Controller/Share20OcsController.php#L447 - publicUploadString, ok := r.Form["publicUpload"] - if ok { - publicUploadFlag, err := strconv.ParseBool(publicUploadString[0]) + publicUploadString := r.FormValue("publicUpload") + if publicUploadString != "" { + publicUploadFlag, err := strconv.ParseBool(publicUploadString) if err != nil { - log.Error().Err(err).Str("publicUpload", publicUploadString[0]).Msg("could not parse publicUpload argument") + log.Error().Err(err).Str("publicUpload", publicUploadString).Msg("could not parse publicUpload argument") return nil, err } @@ -606,24 +633,20 @@ func permissionFromRequest(r *http.Request, h *Handler) (*provider.ResourcePermi permKey = 15 } } else { - permissionsString, ok := r.Form["permissions"] - if !ok { + permissionsString := r.FormValue("permissions") + if permissionsString == "" { // no permission values given return nil, nil } - permKey, err = strconv.Atoi(permissionsString[0]) + permKey, err = strconv.Atoi(permissionsString) if err != nil { log.Error().Str("permissionFromRequest", "shares").Msgf("invalid type: %T", permKey) return nil, fmt.Errorf("invalid type: %T", permKey) } } - p, err := ocPublicPermToCs3(permKey, h) - if err != nil { - return nil, err - } - return p, err + return &permKey, nil } // TODO: add mapping for user share permissions to role diff --git a/vendor/modules.txt b/vendor/modules.txt index 65978eab29..b947fa917a 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -349,7 +349,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1 github.com/cs3org/go-cs3apis/cs3/types/v1beta1 -# github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5 +# github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df ## explicit; go 1.19 github.com/cs3org/reva/v2/cmd/revad/internal/grace github.com/cs3org/reva/v2/cmd/revad/runtime