sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #7540 from owncloud/opt-out-public-link-pw

Browse Source 
[full-ci] add new permission to delete public link password
This commit is contained in:
Michael Barz
2023-10-23 15:43:26 +02:00
committed by GitHub
parent 991cc6e8ba b6e62b3d79
commit c13c04be55
7 changed files with 93 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changelog/unreleased/bump-reva.md
+1
View File
@@ -2,6 +2,7 @@ Enhancement: Bump Reva
bumps reva version
https://github.com/owncloud/ocis/pull/7540
https://github.com/owncloud/ocis/pull/7526
https://github.com/owncloud/ocis/pull/7138
https://github.com/owncloud/ocis/pull/6427
changelog/unreleased/opt-out-public-link-pw.md
+7
View File
@@ -0,0 +1,7 @@
Enhancement: Add new permission to delete public link password
Users with this new permission can now delete passwords on read-only public links. The permission is added to the default roles "Admin" and "Space Admin".
https://github.com/owncloud/ocis/pull/7538
https://github.com/cs3org/reva/pull/4270
https://github.com/owncloud/ocis/issues/7538
go.mod
+1 -1
View File
@@ -13,7 +13,7 @@ require (
github.com/coreos/go-oidc v2.2.1+incompatible
github.com/coreos/go-oidc/v3 v3.7.0
github.com/cs3org/go-cs3apis v0.0.0-20230727093620-0f4399be4543
github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18
github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79
github.com/disintegration/imaging v1.6.2
github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
github.com/egirna/icap-client v0.1.1
go.sum
+2
View File
@@ -1015,6 +1015,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 h1:RP4vT83ghliBeJICDid1CNfbfssFJE+D6eXTPOkxhjk=
github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA=
github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 h1:c6rk7hzCq+9lvOtWKPH6DbGnCHvNQosW2H8YQaslneU=
github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA=
github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
services/settings/pkg/store/defaults/defaults.go
+35
View File
@@ -119,6 +119,11 @@ const (
WritePublicLinkPermissionID string = "11516bbd-7157-49e1-b6ac-d00c820f980b"
// WritePublicLinkPermissionName is the hardcoded setting name for the PublicLink.Write permission
WritePublicLinkPermissionName string = "PublicLink.Write"
// DeleteReadOnlyPublicLinkPasswordID is the hardcoded setting UUID for the ReadOnlyPublicLinkPassword.Delete permission
DeleteReadOnlyPublicLinkPasswordID string = "e9a697c5-c67b-40fc-982b-bcf628e9916d"
// DeleteReadOnlyPublicLinkPasswordName is the hardcoded setting name for the ReadOnlyPublicLinkPassword.Delete permission
DeleteReadOnlyPublicLinkPasswordName string = "ReadOnlyPublicLinkPassword.Delete"
)
// GenerateBundlesDefaultRoles bootstraps the default roles.
@@ -372,6 +377,21 @@ func generateBundleAdminRole() *settingsmsg.Bundle {
},
},
},
{
Id: DeleteReadOnlyPublicLinkPasswordID,
Name: DeleteReadOnlyPublicLinkPasswordName,
DisplayName: "Delete Read-Only Public link password",
Description: "This permission permits to opt out of a public link password enforcement.",
Resource: &settingsmsg.Resource{
Type: settingsmsg.Resource_TYPE_SHARE,
},
Value: &settingsmsg.Setting_PermissionValue{
PermissionValue: &settingsmsg.Permission{
Operation: settingsmsg.Permission_OPERATION_WRITE,
Constraint: settingsmsg.Permission_CONSTRAINT_ALL,
},
},
},
{
Id: ManageSpacePropertiesPermissionID,
Name: ManageSpacePropertiesPermissionName,
@@ -598,6 +618,21 @@ func generateBundleSpaceAdminRole() *settingsmsg.Bundle {
},
},
},
{
Id: DeleteReadOnlyPublicLinkPasswordID,
Name: DeleteReadOnlyPublicLinkPasswordName,
DisplayName: "Delete Read-Only Public link password",
Description: "This permission permits to opt out of a public link password enforcement.",
Resource: &settingsmsg.Resource{
Type: settingsmsg.Resource_TYPE_SHARE,
},
Value: &settingsmsg.Setting_PermissionValue{
PermissionValue: &settingsmsg.Permission{
Operation: settingsmsg.Permission_OPERATION_WRITE,
Constraint: settingsmsg.Permission_CONSTRAINT_ALL,
},
},
},
},
}
}
vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
Generated Vendored
+46 -3
View File
@@ -19,11 +19,13 @@
package shares
import (
"context"
"encoding/json"
"fmt"
"net/http"
"strconv"
userv1beta1 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
permissionsv1beta1 "github.com/cs3org/go-cs3apis/cs3/permissions/v1beta1"
rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
link "github.com/cs3org/go-cs3apis/cs3/sharing/link/v1beta1"
@@ -360,7 +362,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
return
}
if !sRes.Info.PermissionSet.UpdateGrant {
if sRes.Info == nil || !sRes.Info.GetPermissionSet().UpdateGrant {
response.WriteOCSError(w, r, response.MetaUnauthorized.StatusCode, "missing permissions to update share", err)
return
}
@@ -469,10 +471,16 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
newPassword, ok := r.Form["password"]
// enforcePassword
if h.enforcePassword(permKey) {
if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 {
response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", err)
p, err := conversions.NewPermissions(decreasePermissionsIfNecessary(*permKey))
if err != nil {
response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check permissions from request", err)
return
}
if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 {
if h.checkPasswordEnforcement(ctx, user, p, w, r) != nil {
return
}
}
}
// update or clear password
@@ -687,6 +695,41 @@ func permKeyFromRequest(r *http.Request, h *Handler) (*int, error) {
return &permKey, nil
}
// checkPasswordEnforcement checks if the password needs to be set for a link
// some users can opt out of the enforcement based on a user permission
func (h *Handler) checkPasswordEnforcement(ctx context.Context, user *userv1beta1.User, perm conversions.Permissions, w http.ResponseWriter, r *http.Request) error {
// Non-read-only links
if perm != conversions.PermissionRead {
response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", nil)
return errors.New("missing required password")
}
// Check if the user is allowed to opt out of the password enforcement
// for read-only links
gwC, err := h.getClient()
if err != nil {
response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "could not check permission", err)
return errors.New("could not check permission")
}
resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{
SubjectRef: &permissionsv1beta1.SubjectReference{
Spec: &permissionsv1beta1.SubjectReference_UserId{
UserId: user.Id,
},
},
Permission: "ReadOnlyPublicLinkPassword.Delete",
})
if err != nil {
response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err)
return errors.New("failed to check user permission")
}
if resp.Status.Code != rpc.Code_CODE_OK {
response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to delete the password from the public link", nil)
return errors.New("user is not allowed to delete the password from the public link")
}
return nil
}
// TODO: add mapping for user share permissions to role
// Maps oc10 public link permissions to roles
vendor/modules.txt
Vendored
+1 -1
View File
@@ -357,7 +357,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
github.com/cs3org/go-cs3apis/cs3/types/v1beta1
# github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18
# github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79
## explicit; go 1.20
github.com/cs3org/reva/v2/cmd/revad/internal/grace
github.com/cs3org/reva/v2/cmd/revad/runtime