From d92248c6641ab58cf1bd6b268723937e6ba39745 Mon Sep 17 00:00:00 2001
From: bo0tzz <git@bo0tzz.me>
Date: Tue, 20 Oct 2026 15:25:59 +0200
Subject: [PATCH] fix(server): require upload access for checksum duplicate
 check (#32559)

* fix(server): require upload access for checksum duplicate check

* fix(server): use the upload access check for the checksum short circuit

(cherry picked from commit 5c02b17495947d7332cce13273226082bd8ae2a1)
---
 server/src/services/asset-media.service.spec.ts | 8 ++++++++
 server/src/services/asset-media.service.ts      | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/server/src/services/asset-media.service.spec.ts b/server/src/services/asset-media.service.spec.ts
index 444a1fa56..729b64325 100644
--- a/server/src/services/asset-media.service.spec.ts
+++ b/server/src/services/asset-media.service.spec.ts
@@ -183,6 +183,14 @@ describe(AssetMediaService.name, () => {
       await expect(sut.getUploadAssetIdByChecksum(authStub.admin)).resolves.toBe(undefined);
     });
 
+    it('should reject a shared link without upload permission', async () => {
+      const auth = AuthFactory.from().sharedLink({ allowUpload: false }).build();
+      await expect(sut.getUploadAssetIdByChecksum(auth, file1.toString('hex'))).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+      expect(mocks.asset.getUploadAssetIdByChecksum).not.toHaveBeenCalled();
+    });
+
     it('should handle a non-existent asset', async () => {
       await expect(sut.getUploadAssetIdByChecksum(authStub.admin, file1.toString('hex'))).resolves.toBeUndefined();
       expect(mocks.asset.getUploadAssetIdByChecksum).toHaveBeenCalledWith(authStub.admin.user.id, file1);
diff --git a/server/src/services/asset-media.service.ts b/server/src/services/asset-media.service.ts
index 7b4193065..9ee927039 100644
--- a/server/src/services/asset-media.service.ts
+++ b/server/src/services/asset-media.service.ts
@@ -48,6 +48,8 @@ export class AssetMediaService extends BaseService {
       return;
     }
 
+    await this.requireAccess({ auth, permission: Permission.AssetUpload, ids: [auth.user.id] });
+
     const assetId = await this.assetRepository.getUploadAssetIdByChecksum(auth.user.id, fromChecksum(checksum));
     if (!assetId) {
       return;