diff --git a/changelog/unreleased/denials.md b/changelog/unreleased/denials.md new file mode 100644 index 000000000..7532741b6 --- /dev/null +++ b/changelog/unreleased/denials.md @@ -0,0 +1,5 @@ +Enhancement: Deny access to resources + +We added an experimental feature to deny access to a certain resource. This feature is disabled by default and considered as EXPERIMENTAL. You can enable it by setting FRONTEND_OCS_ENABLE_DENIALS to `true`. It announces an available deny access permission via WebDAV on each resource. By convention it is only possible to deny access on folders. The clients can check the presence of the feature by the capability `deny_access` in the `files_sharing` section. + +https://github.com/owncloud/ocis/pull/4903 diff --git a/changelog/unreleased/update-reva-rc1.md b/changelog/unreleased/update-reva-rc1.md index 8c39aa82b..a37e76c96 100644 --- a/changelog/unreleased/update-reva-rc1.md +++ b/changelog/unreleased/update-reva-rc1.md @@ -8,5 +8,6 @@ https://github.com/owncloud/ocis/pull/4719 https://github.com/owncloud/ocis/pull/4750 https://github.com/owncloud/ocis/pull/4833 https://github.com/owncloud/ocis/pull/4867 +https://github.com/owncloud/ocis/pull/4903 https://github.com/owncloud/ocis/pull/4908 https://github.com/owncloud/ocis/pull/4915 diff --git a/go.mod b/go.mod index cbd12b7e9..41bccefa6 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/blevesearch/bleve/v2 v2.3.5 github.com/coreos/go-oidc/v3 v3.4.0 github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965 - github.com/cs3org/reva/v2 v2.10.1-0.20221027064516-df9917ef5f46 + github.com/cs3org/reva/v2 v2.10.1-0.20221028083225-fdea5de75e96 github.com/disintegration/imaging v1.6.2 github.com/ggwhite/go-masker v1.0.9 github.com/go-chi/chi/v5 v5.0.7 diff --git a/go.sum b/go.sum index 676843a04..9d0309484 100644 --- a/go.sum +++ b/go.sum @@ -342,10 +342,8 @@ github.com/crewjam/saml v0.4.6 h1:XCUFPkQSJLvzyl4cW9OvpWUbRf0gE7VUpU8ZnilbeM4= github.com/crewjam/saml v0.4.6/go.mod h1:ZBOXnNPFzB3CgOkRm7Nd6IVdkG+l/wF+0ZXLqD96t1A= github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965 h1:y4n2j68LLnvac+zw/al8MfPgO5aQiIwLmHM/JzYN8AM= github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY= -github.com/cs3org/reva/v2 v2.10.1-0.20221026092609-d31dcb038e67 h1:qyXh4e/EcXcV/KaA0H7+Zms9aBfXh0W/YGZZEFbjBas= -github.com/cs3org/reva/v2 v2.10.1-0.20221026092609-d31dcb038e67/go.mod h1:Gv4tlxYM4wGKP8DD/S/TVsv619Z00QpsFbTR/2wfjVw= -github.com/cs3org/reva/v2 v2.10.1-0.20221027064516-df9917ef5f46 h1:CCS34zfgmA7tPzZutBovJ0IDQVa5+LkY8UVymKR8W8g= -github.com/cs3org/reva/v2 v2.10.1-0.20221027064516-df9917ef5f46/go.mod h1:Gv4tlxYM4wGKP8DD/S/TVsv619Z00QpsFbTR/2wfjVw= +github.com/cs3org/reva/v2 v2.10.1-0.20221028083225-fdea5de75e96 h1:zirPCF7XxGpWh/ZN2MES3muW2dzasjhUTOPUj0KoB9s= +github.com/cs3org/reva/v2 v2.10.1-0.20221028083225-fdea5de75e96/go.mod h1:Gv4tlxYM4wGKP8DD/S/TVsv619Z00QpsFbTR/2wfjVw= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY= github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4= @@ -1404,15 +1402,11 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= -golang.org/x/exp v0.0.0-20220518171630-0b5c67f07fdf h1:oXVg4h2qJDd9htKxb5SCpFBHLipW6hXmL3qpUixS2jw= -golang.org/x/exp v0.0.0-20220518171630-0b5c67f07fdf/go.mod h1:yh0Ynu2b5ZUe3MQfp2nM0ecK7wsgouWTDN0FNeJuIys= golang.org/x/exp v0.0.0-20221026004748-78e5e7837ae6 h1:mC6uOkPi9SUk8A59jZvw7//rlyc+MlELtQUCyOUSKZQ= golang.org/x/exp v0.0.0-20221026004748-78e5e7837ae6/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE= golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= -golang.org/x/image v0.0.0-20220321031419-a8550c1d254a h1:LnH9RNcpPv5Kzi15lXg42lYMPUf0x8CuPv1YnvBWZAg= -golang.org/x/image v0.0.0-20220321031419-a8550c1d254a/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM= golang.org/x/image v0.1.0 h1:r8Oj8ZA2Xy12/b5KZYj3tuv7NG/fBz3TwQVvpJ9l8Rk= golang.org/x/image v0.1.0/go.mod h1:iyPr49SD/G/TBxYVB/9RRtGUT5eNbo2u4NamWeQcD5c= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= @@ -1934,8 +1928,6 @@ google.golang.org/genproto v0.0.0-20220915135415-7fd63a7952de/go.mod h1:0Nb8Qy+S google.golang.org/genproto v0.0.0-20220916172020-2692e8806bfa/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo= google.golang.org/genproto v0.0.0-20220919141832-68c03719ef51/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo= google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006/go.mod h1:ht8XFiar2npT/g4vkk7O0WYS1sHOHbdujxbEp7CJWbw= -google.golang.org/genproto v0.0.0-20221024183307-1bc688fe9f3e h1:S9GbmC1iCgvbLyAokVCwiO6tVIrU9Y7c5oMx1V/ki/Y= -google.golang.org/genproto v0.0.0-20221024183307-1bc688fe9f3e/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s= google.golang.org/genproto v0.0.0-20221025140454-527a21cfbd71 h1:GEgb2jF5zxsFJpJfg9RoDDWm7tiwc/DDSTE2BtLUkXU= google.golang.org/genproto v0.0.0-20221025140454-527a21cfbd71/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s= google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs= diff --git a/services/frontend/pkg/config/config.go b/services/frontend/pkg/config/config.go index 2af685f4a..de4837c24 100644 --- a/services/frontend/pkg/config/config.go +++ b/services/frontend/pkg/config/config.go @@ -117,6 +117,7 @@ type OCS struct { ResourceInfoCaches ResourceInfoCaches `yaml:"resource_info_caches,omitempty"` // only used for redis CacheWarmupDriver string `yaml:"cache_warmup_driver,omitempty"` // not supported by the oCIS product, therefore not part of docs CacheWarmupDrivers CacheWarmupDrivers `yaml:"cache_warmup_drivers,omitempty"` // not supported by the oCIS product, therefore not part of docs + EnableDenials bool `yaml:"enable_denials" env:"FRONTEND_OCS_ENABLE_DENIALS" desc:"EXPERIMENTAL: enable the feature to deny access on folders."` } // ResourceInfoCaches holds resource info cache configurations diff --git a/services/frontend/pkg/revaconfig/config.go b/services/frontend/pkg/revaconfig/config.go index 60070e7bd..32f66ae43 100644 --- a/services/frontend/pkg/revaconfig/config.go +++ b/services/frontend/pkg/revaconfig/config.go @@ -146,6 +146,7 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error "prefix": cfg.OCS.Prefix, "additional_info_attribute": cfg.OCS.AdditionalInfoAttribute, "machine_auth_apikey": cfg.MachineAuthAPIKey, + "enable_denials": cfg.OCS.EnableDenials, "cache_warmup_driver": cfg.OCS.CacheWarmupDriver, "cache_warmup_drivers": map[string]interface{}{ "cbox": map[string]interface{}{ @@ -198,6 +199,7 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error "resharing": cfg.EnableResharing, "group_sharing": true, "sharing_roles": true, + "deny_access": cfg.OCS.EnableDenials, "auto_accept_share": true, "share_with_group_members_only": true, "share_with_membership_groups_only": true, diff --git a/tests/acceptance/expected-failures-API-on-OCIS-storage.md b/tests/acceptance/expected-failures-API-on-OCIS-storage.md index 549adef65..669ce54a2 100644 --- a/tests/acceptance/expected-failures-API-on-OCIS-storage.md +++ b/tests/acceptance/expected-failures-API-on-OCIS-storage.md @@ -194,6 +194,10 @@ File and sync features in a shared scenario - [apiShareManagementBasicToShares/createShareToSharesFolder.feature:802](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiShareManagementBasicToShares/createShareToSharesFolder.feature#L802) - [apiShareManagementBasicToShares/createShareToSharesFolder.feature:803](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiShareManagementBasicToShares/createShareToSharesFolder.feature#L803) +#### [different webdav permissions in ocis](https://github.com/owncloud/ocis/issues/4929) + +- [apiShareManagementToShares/mergeShare.feature:93](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiShareManagementToShares/mergeShare.feature#L93) + #### [file_target of an auto-renamed file is not correct directly after sharing](https://github.com/owncloud/core/issues/32322) - [apiShareManagementToShares/mergeShare.feature:105](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiShareManagementToShares/mergeShare.feature#L105)