bump reva

Signed-off-by: jkoberg <jkoberg@owncloud.com>

changelog/unreleased/bump-reva.md

@@ -0,0 +1,5 @@
+Enhancement: Bump Reva Version
+
+Bumps the reva version
+
+https://github.com/owncloud/ocis/pull/6186

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.4.0
 	github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965
-	github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5
+	github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df
 	github.com/disintegration/imaging v1.6.2
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
 	github.com/egirna/icap-client v0.1.1

go.sum

@@ -627,8 +627,8 @@ github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo
 github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
 github.com/crewjam/saml v0.4.13 h1:TYHggH/hwP7eArqiXSJUvtOPNzQDyQ7vwmwEqlFWhMc=
 github.com/crewjam/saml v0.4.13/go.mod h1:igEejV+fihTIlHXYP8zOec3V5A8y3lws5bQBFsTm4gA=
-github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5 h1:wloX5LiqRxwh2ID9O+em8O5VU1h2ZN5u6tPceAdLNDI=
+github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df h1:3fcCvjkxk6RcAKMWjxzvSsLFIsgEr1REYAXBE8HGNOs=
-github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5/go.mod h1:VxBmpOvIKlgKLPOsHun+fABopzX+3ZELPAp3N5bQMsM=
+github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df/go.mod h1:VxBmpOvIKlgKLPOsHun+fABopzX+3ZELPAp3N5bQMsM=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=

vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go

@@ -40,6 +40,8 @@ import (
 	"github.com/pkg/errors"
 )
 
+var _defaultPublicLinkPermission = 1
+
 func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request, statInfo *provider.ResourceInfo) (*link.PublicShare, *ocsError) {
 	ctx := r.Context()
 	log := appctx.GetLogger(ctx)
@@ -53,27 +55,39 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request,
 		}
 	}
 
-	user := ctxpkg.ContextMustGetUser(ctx)
+	permKey, err := permKeyFromRequest(r, h)
-	resp, err := c.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{
-		SubjectRef: &permissionsv1beta1.SubjectReference{
-			Spec: &permissionsv1beta1.SubjectReference_UserId{
-				UserId: user.Id,
-			},
-		},
-		Permission: "PublicLink.Write",
-	})
 	if err != nil {
 		return nil, &ocsError{
-			Code:    response.MetaServerError.StatusCode,
+			Code:    response.MetaBadRequest.StatusCode,
-			Message: "failed to check user permission",
+			Message: "Could not read permission from request",
 			Error:   err,
 		}
 	}
 
-	if resp.Status.Code != rpc.Code_CODE_OK {
+	// NOTE: one is allowed to create an internal link without the `Publink.Write` permission
-		return nil, &ocsError{
+	if permKey != nil && *permKey != 0 {
-			Code:    response.MetaForbidden.StatusCode,
+		user := ctxpkg.ContextMustGetUser(ctx)
-			Message: "user is not allowed to create a public link",
+		resp, err := c.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{
+			SubjectRef: &permissionsv1beta1.SubjectReference{
+				Spec: &permissionsv1beta1.SubjectReference_UserId{
+					UserId: user.Id,
+				},
+			},
+			Permission: "PublicLink.Write",
+		})
+		if err != nil {
+			return nil, &ocsError{
+				Code:    response.MetaServerError.StatusCode,
+				Message: "failed to check user permission",
+				Error:   err,
+			}
+		}
+
+		if resp.Status.Code != rpc.Code_CODE_OK {
+			return nil, &ocsError{
+				Code:    response.MetaForbidden.StatusCode,
+				Message: "user is not allowed to create a public link",
+			}
 		}
 	}
 
@@ -113,19 +127,18 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request,
 		}
 	}
 
-	newPermissions, err := permissionFromRequest(r, h)
+	permissions, err := ocPublicPermToCs3(permKey, h)
 	if err != nil {
 		return nil, &ocsError{
 			Code:    response.MetaBadRequest.StatusCode,
-			Message: "Could not read permission from request",
+			Message: "Could not create permission from permission key",
 			Error:   err,
 		}
 	}
-
+	if permissions == nil {
-	if newPermissions == nil {
 		// default perms: read-only
 		// TODO: the default might change depending on allowed permissions and configs
-		newPermissions, err = ocPublicPermToCs3(1, h)
+		permissions, err = ocPublicPermToCs3(&_defaultPublicLinkPermission, h)
 		if err != nil {
 			return nil, &ocsError{
 				Code:    response.MetaServerError.StatusCode,
@@ -137,14 +150,14 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request,
 
 	if statInfo != nil && statInfo.Type == provider.ResourceType_RESOURCE_TYPE_FILE {
 		// Single file shares should never have delete or create permissions
-		role := conversions.RoleFromResourcePermissions(newPermissions, true)
+		role := conversions.RoleFromResourcePermissions(permissions, true)
-		permissions := role.OCSPermissions()
+		p := role.OCSPermissions()
-		permissions &^= conversions.PermissionCreate
+		p &^= conversions.PermissionCreate
-		permissions &^= conversions.PermissionDelete
+		p &^= conversions.PermissionDelete
-		newPermissions = conversions.RoleFromOCSPermissions(permissions).CS3ResourcePermissions()
+		permissions = conversions.RoleFromOCSPermissions(p).CS3ResourcePermissions()
 	}
 
-	if !sufficientPermissions(statInfo.PermissionSet, newPermissions, true) {
+	if !sufficientPermissions(statInfo.PermissionSet, permissions, true) {
 		response.WriteOCSError(w, r, http.StatusNotFound, "no share permission", nil)
 		return nil, &ocsError{
 			Code:    http.StatusNotFound,
@@ -157,7 +170,7 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request,
 		ResourceInfo: statInfo,
 		Grant: &link.Grant{
 			Permissions: &link.PublicSharePermissions{
-				Permissions: newPermissions,
+				Permissions: permissions,
 			},
 			Password: r.FormValue("password"),
 		},
@@ -296,23 +309,11 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 	}
 
 	ctx := r.Context()
-
 	user := ctxpkg.ContextMustGetUser(ctx)
-	resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{
-		SubjectRef: &permissionsv1beta1.SubjectReference{
-			Spec: &permissionsv1beta1.SubjectReference_UserId{
-				UserId: user.Id,
-			},
-		},
-		Permission: "PublicLink.Write",
-	})
-	if err != nil {
-		response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err)
-		return
-	}
 
-	if resp.Status.Code != rpc.Code_CODE_OK {
+	permKey, err := permKeyFromRequest(r, h)
-		response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to create a public link", nil)
+	if err != nil {
+		response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "invalid permissions", err)
 		return
 	}
 
@@ -330,8 +331,30 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 		return
 	}
 
-	u := ctxpkg.ContextMustGetUser(r.Context())
+	createdByUser := publicshare.IsCreatedByUser(*before.Share, user)
-	if !publicshare.IsCreatedByUser(*before.Share, u) {
+
+	// NOTE: you are allowed to update a link TO a public link without the `PublicLink.Write` permission if you created it yourself
+	if (permKey != nil && *permKey != 0) || !createdByUser {
+		resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{
+			SubjectRef: &permissionsv1beta1.SubjectReference{
+				Spec: &permissionsv1beta1.SubjectReference_UserId{
+					UserId: user.Id,
+				},
+			},
+			Permission: "PublicLink.Write",
+		})
+		if err != nil {
+			response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err)
+			return
+		}
+
+		if resp.Status.Code != rpc.Code_CODE_OK {
+			response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to update the public link", nil)
+			return
+		}
+	}
+
+	if !createdByUser {
 		sRes, err := gwC.Stat(r.Context(), &provider.StatRequest{Ref: &provider.Reference{ResourceId: before.Share.ResourceId}})
 		if err != nil {
 			log.Err(err).Interface("resource_id", before.Share.ResourceId).Msg("failed to stat shared resource")
@@ -368,7 +391,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 	}
 
 	// Permissions
-	newPermissions, err := permissionFromRequest(r, h)
+	newPermissions, err := ocPublicPermToCs3(permKey, h)
 	logger.Debug().Interface("newPermissions", newPermissions).Msg("Parsed permissions")
 	if err != nil {
 		response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "invalid permissions", err)
@@ -563,9 +586,12 @@ func decreasePermissionsIfNecessary(perm int) int {
 	return perm
 }
 
-func ocPublicPermToCs3(permKey int, h *Handler) (*provider.ResourcePermissions, error) {
+func ocPublicPermToCs3(pk *int, h *Handler) (*provider.ResourcePermissions, error) {
+	if pk == nil {
+		return nil, nil
+	}
 
-	permKey = decreasePermissionsIfNecessary(permKey)
+	permKey := decreasePermissionsIfNecessary(*pk)
 
 	// TODO refactor this ocPublicPermToRole[permKey] check into a conversions.NewPublicSharePermissions?
 	// not all permissions are possible for public shares
@@ -583,7 +609,8 @@ func ocPublicPermToCs3(permKey int, h *Handler) (*provider.ResourcePermissions,
 	return conversions.RoleFromOCSPermissions(perm).CS3ResourcePermissions(), nil
 }
 
-func permissionFromRequest(r *http.Request, h *Handler) (*provider.ResourcePermissions, error) {
+// pointer will be nil if no permission is set
+func permKeyFromRequest(r *http.Request, h *Handler) (*int, error) {
 	var err error
 	// phoenix sends: {"permissions": 15}. See ocPublicPermToRole struct for mapping
 
@@ -593,11 +620,11 @@ func permissionFromRequest(r *http.Request, h *Handler) (*provider.ResourcePermi
 
 	// handle legacy "publicUpload" arg that overrides permissions differently depending on the scenario
 	// https://github.com/owncloud/core/blob/v10.4.0/apps/files_sharing/lib/Controller/Share20OcsController.php#L447
-	publicUploadString, ok := r.Form["publicUpload"]
+	publicUploadString := r.FormValue("publicUpload")
-	if ok {
+	if publicUploadString != "" {
-		publicUploadFlag, err := strconv.ParseBool(publicUploadString[0])
+		publicUploadFlag, err := strconv.ParseBool(publicUploadString)
 		if err != nil {
-			log.Error().Err(err).Str("publicUpload", publicUploadString[0]).Msg("could not parse publicUpload argument")
+			log.Error().Err(err).Str("publicUpload", publicUploadString).Msg("could not parse publicUpload argument")
 			return nil, err
 		}
 
@@ -606,24 +633,20 @@ func permissionFromRequest(r *http.Request, h *Handler) (*provider.ResourcePermi
 			permKey = 15
 		}
 	} else {
-		permissionsString, ok := r.Form["permissions"]
+		permissionsString := r.FormValue("permissions")
-		if !ok {
+		if permissionsString == "" {
 			// no permission values given
 			return nil, nil
 		}
 
-		permKey, err = strconv.Atoi(permissionsString[0])
+		permKey, err = strconv.Atoi(permissionsString)
 		if err != nil {
 			log.Error().Str("permissionFromRequest", "shares").Msgf("invalid type: %T", permKey)
 			return nil, fmt.Errorf("invalid type: %T", permKey)
 		}
 	}
 
-	p, err := ocPublicPermToCs3(permKey, h)
+	return &permKey, nil
-	if err != nil {
-		return nil, err
-	}
-	return p, err
 }
 
 // TODO: add mapping for user share permissions to role

vendor/modules.txt

@@ -349,7 +349,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.12.1-0.20230428064036-4434df8122a5
+# github.com/cs3org/reva/v2 v2.12.1-0.20230428092715-44a95fb7c7df
 ## explicit; go 1.19
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime