From 75819ba6ad36d7621a8af825b523cf7563983045 Mon Sep 17 00:00:00 2001 From: Michael Barz Date: Thu, 19 Oct 2023 22:09:20 +0200 Subject: [PATCH 1/2] add new permission to delete public link password --- .../unreleased/opt-out-public-link-pw.md | 7 ++++ .../settings/pkg/store/defaults/defaults.go | 35 +++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 changelog/unreleased/opt-out-public-link-pw.md diff --git a/changelog/unreleased/opt-out-public-link-pw.md b/changelog/unreleased/opt-out-public-link-pw.md new file mode 100644 index 000000000..96218cf19 --- /dev/null +++ b/changelog/unreleased/opt-out-public-link-pw.md @@ -0,0 +1,7 @@ +Enhancement: Add new permission to delete public link password + +Users with this new permission can now delete passwords on read-only public links. The permission is added to the default roles "Admin" and "Space Admin". + +https://github.com/owncloud/ocis/pull/7538 +https://github.com/cs3org/reva/pull/4270 +https://github.com/owncloud/ocis/issues/7538 diff --git a/services/settings/pkg/store/defaults/defaults.go b/services/settings/pkg/store/defaults/defaults.go index 46cbf2d86..5e9eb20e7 100644 --- a/services/settings/pkg/store/defaults/defaults.go +++ b/services/settings/pkg/store/defaults/defaults.go @@ -119,6 +119,11 @@ const ( WritePublicLinkPermissionID string = "11516bbd-7157-49e1-b6ac-d00c820f980b" // WritePublicLinkPermissionName is the hardcoded setting name for the PublicLink.Write permission WritePublicLinkPermissionName string = "PublicLink.Write" + + // DeleteReadOnlyPublicLinkPasswordID is the hardcoded setting UUID for the ReadOnlyPublicLinkPassword.Delete permission + DeleteReadOnlyPublicLinkPasswordID string = "e9a697c5-c67b-40fc-982b-bcf628e9916d" + // DeleteReadOnlyPublicLinkPasswordName is the hardcoded setting name for the ReadOnlyPublicLinkPassword.Delete permission + DeleteReadOnlyPublicLinkPasswordName string = "ReadOnlyPublicLinkPassword.Delete" ) // GenerateBundlesDefaultRoles bootstraps the default roles. @@ -372,6 +377,21 @@ func generateBundleAdminRole() *settingsmsg.Bundle { }, }, }, + { + Id: DeleteReadOnlyPublicLinkPasswordID, + Name: DeleteReadOnlyPublicLinkPasswordName, + DisplayName: "Delete Read-Only Public link password", + Description: "This permission permits to opt out of a public link password enforcement.", + Resource: &settingsmsg.Resource{ + Type: settingsmsg.Resource_TYPE_SHARE, + }, + Value: &settingsmsg.Setting_PermissionValue{ + PermissionValue: &settingsmsg.Permission{ + Operation: settingsmsg.Permission_OPERATION_WRITE, + Constraint: settingsmsg.Permission_CONSTRAINT_ALL, + }, + }, + }, { Id: ManageSpacePropertiesPermissionID, Name: ManageSpacePropertiesPermissionName, @@ -598,6 +618,21 @@ func generateBundleSpaceAdminRole() *settingsmsg.Bundle { }, }, }, + { + Id: DeleteReadOnlyPublicLinkPasswordID, + Name: DeleteReadOnlyPublicLinkPasswordName, + DisplayName: "Delete Read-Only Public link password", + Description: "This permission permits to opt out of a public link password enforcement.", + Resource: &settingsmsg.Resource{ + Type: settingsmsg.Resource_TYPE_SHARE, + }, + Value: &settingsmsg.Setting_PermissionValue{ + PermissionValue: &settingsmsg.Permission{ + Operation: settingsmsg.Permission_OPERATION_WRITE, + Constraint: settingsmsg.Permission_CONSTRAINT_ALL, + }, + }, + }, }, } } From b6e62b3d795ee74d0123faf4edcb8bc28680f208 Mon Sep 17 00:00:00 2001 From: Michael Barz Date: Mon, 23 Oct 2023 14:51:59 +0200 Subject: [PATCH 2/2] update reva to latest edge --- changelog/unreleased/bump-reva.md | 1 + go.mod | 2 +- go.sum | 2 + .../handlers/apps/sharing/shares/public.go | 49 +++++++++++++++++-- vendor/modules.txt | 2 +- 5 files changed, 51 insertions(+), 5 deletions(-) diff --git a/changelog/unreleased/bump-reva.md b/changelog/unreleased/bump-reva.md index 84da19336..2b4e21340 100644 --- a/changelog/unreleased/bump-reva.md +++ b/changelog/unreleased/bump-reva.md @@ -2,6 +2,7 @@ Enhancement: Bump Reva bumps reva version +https://github.com/owncloud/ocis/pull/7540 https://github.com/owncloud/ocis/pull/7526 https://github.com/owncloud/ocis/pull/7138 https://github.com/owncloud/ocis/pull/6427 diff --git a/go.mod b/go.mod index 54724081d..256b0da81 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/coreos/go-oidc v2.2.1+incompatible github.com/coreos/go-oidc/v3 v3.7.0 github.com/cs3org/go-cs3apis v0.0.0-20230727093620-0f4399be4543 - github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 + github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 github.com/disintegration/imaging v1.6.2 github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e github.com/egirna/icap-client v0.1.1 diff --git a/go.sum b/go.sum index 142e6ed2b..5a5501461 100644 --- a/go.sum +++ b/go.sum @@ -1015,6 +1015,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c= github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME= github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 h1:RP4vT83ghliBeJICDid1CNfbfssFJE+D6eXTPOkxhjk= github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA= +github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 h1:c6rk7hzCq+9lvOtWKPH6DbGnCHvNQosW2H8YQaslneU= +github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79/go.mod h1:rY/itYaRBW7NjLpLIrWHSUirqEeBz5kdKbF5Dh96yMA= github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go index b0487216b..36d038ee8 100644 --- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go +++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go @@ -19,11 +19,13 @@ package shares import ( + "context" "encoding/json" "fmt" "net/http" "strconv" + userv1beta1 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1" permissionsv1beta1 "github.com/cs3org/go-cs3apis/cs3/permissions/v1beta1" rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1" link "github.com/cs3org/go-cs3apis/cs3/sharing/link/v1beta1" @@ -360,7 +362,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar return } - if !sRes.Info.PermissionSet.UpdateGrant { + if sRes.Info == nil || !sRes.Info.GetPermissionSet().UpdateGrant { response.WriteOCSError(w, r, response.MetaUnauthorized.StatusCode, "missing permissions to update share", err) return } @@ -469,10 +471,16 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar newPassword, ok := r.Form["password"] // enforcePassword if h.enforcePassword(permKey) { - if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 { - response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", err) + p, err := conversions.NewPermissions(decreasePermissionsIfNecessary(*permKey)) + if err != nil { + response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check permissions from request", err) return } + if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 { + if h.checkPasswordEnforcement(ctx, user, p, w, r) != nil { + return + } + } } // update or clear password @@ -687,6 +695,41 @@ func permKeyFromRequest(r *http.Request, h *Handler) (*int, error) { return &permKey, nil } +// checkPasswordEnforcement checks if the password needs to be set for a link +// some users can opt out of the enforcement based on a user permission +func (h *Handler) checkPasswordEnforcement(ctx context.Context, user *userv1beta1.User, perm conversions.Permissions, w http.ResponseWriter, r *http.Request) error { + // Non-read-only links + if perm != conversions.PermissionRead { + response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", nil) + return errors.New("missing required password") + } + // Check if the user is allowed to opt out of the password enforcement + // for read-only links + gwC, err := h.getClient() + if err != nil { + response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "could not check permission", err) + return errors.New("could not check permission") + } + resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{ + SubjectRef: &permissionsv1beta1.SubjectReference{ + Spec: &permissionsv1beta1.SubjectReference_UserId{ + UserId: user.Id, + }, + }, + Permission: "ReadOnlyPublicLinkPassword.Delete", + }) + if err != nil { + response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err) + return errors.New("failed to check user permission") + } + + if resp.Status.Code != rpc.Code_CODE_OK { + response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to delete the password from the public link", nil) + return errors.New("user is not allowed to delete the password from the public link") + } + return nil +} + // TODO: add mapping for user share permissions to role // Maps oc10 public link permissions to roles diff --git a/vendor/modules.txt b/vendor/modules.txt index e0051c7cc..cfa2273f7 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -357,7 +357,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1 github.com/cs3org/go-cs3apis/cs3/types/v1beta1 -# github.com/cs3org/reva/v2 v2.16.1-0.20231020092327-051345fa7b18 +# github.com/cs3org/reva/v2 v2.16.1-0.20231023124625-f9a66375fd79 ## explicit; go 1.20 github.com/cs3org/reva/v2/cmd/revad/internal/grace github.com/cs3org/reva/v2/cmd/revad/runtime