Skip to content

Commit 553224b

Browse files
provokateurinprovokateurin
authored
Merge pull request #46810 from nextcloud/refactor/files_sharing/security-attributes
2 parents 5bfe8df + 9128a23 commit 553224b

10 files changed

Lines changed: 57 additions & 75 deletions

‎apps/files_sharing/lib/Controller/AcceptController.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010

1111
use OCA\Files_Sharing\AppInfo\Application;
1212
use OCP\AppFramework\Controller;
13+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
14+
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
1315
use OCP\AppFramework\Http\Attribute\OpenAPI;
1416
use OCP\AppFramework\Http\NotFoundResponse;
1517
use OCP\AppFramework\Http\RedirectResponse;
@@ -40,10 +42,8 @@ public function __construct(IRequest $request, ShareManager $shareManager, IUser
4042
$this->urlGenerator = $urlGenerator;
4143
}
4244

43-
/**
44-
* @NoAdminRequired
45-
* @NoCSRFRequired
46-
*/
45+
#[NoAdminRequired]
46+
#[NoCSRFRequired]
4747
public function accept(string $shareId): Response {
4848
try {
4949
$share = $this->shareManager->getShareById($shareId);

‎apps/files_sharing/lib/Controller/DeletedShareAPIController.php‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
use OCA\Files_Sharing\ResponseDefinitions;
1212
use OCP\App\IAppManager;
1313
use OCP\AppFramework\Http;
14+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
1415
use OCP\AppFramework\Http\DataResponse;
1516
use OCP\AppFramework\OCS\OCSException;
1617
use OCP\AppFramework\OCS\OCSNotFoundException;
@@ -158,14 +159,13 @@ private function formatShare(IShare $share): array {
158159
}
159160

160161
/**
161-
* @NoAdminRequired
162-
*
163162
* Get a list of all deleted shares
164163
*
165164
* @return DataResponse<Http::STATUS_OK, Files_SharingDeletedShare[], array{}>
166165
*
167166
* 200: Deleted shares returned
168167
*/
168+
#[NoAdminRequired]
169169
public function index(): DataResponse {
170170
$groupShares = $this->shareManager->getDeletedSharedWith($this->userId, IShare::TYPE_GROUP, null, -1, 0);
171171
$roomShares = $this->shareManager->getDeletedSharedWith($this->userId, IShare::TYPE_ROOM, null, -1, 0);
@@ -182,8 +182,6 @@ public function index(): DataResponse {
182182
}
183183

184184
/**
185-
* @NoAdminRequired
186-
*
187185
* Undelete a deleted share
188186
*
189187
* @param string $id ID of the share
@@ -193,6 +191,7 @@ public function index(): DataResponse {
193191
*
194192
* 200: Share undeleted successfully
195193
*/
194+
#[NoAdminRequired]
196195
public function undelete(string $id): DataResponse {
197196
try {
198197
$share = $this->shareManager->getShareById($id, $this->userId);

‎apps/files_sharing/lib/Controller/ExternalSharesController.php‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
namespace OCA\Files_Sharing\Controller;
88

99
use OCP\AppFramework\Controller;
10+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
11+
use OCP\AppFramework\Http\Attribute\PublicPage;
1012
use OCP\AppFramework\Http\DataResponse;
1113
use OCP\AppFramework\Http\JSONResponse;
1214
use OCP\Http\Client\IClientService;
@@ -30,34 +32,34 @@ public function __construct(
3032
}
3133

3234
/**
33-
* @NoAdminRequired
3435
* @NoOutgoingFederatedSharingRequired
3536
*
3637
* @return JSONResponse
3738
*/
39+
#[NoAdminRequired]
3840
public function index() {
3941
return new JSONResponse($this->externalManager->getOpenShares());
4042
}
4143

4244
/**
43-
* @NoAdminRequired
4445
* @NoOutgoingFederatedSharingRequired
4546
*
4647
* @param int $id
4748
* @return JSONResponse
4849
*/
50+
#[NoAdminRequired]
4951
public function create($id) {
5052
$this->externalManager->acceptShare($id);
5153
return new JSONResponse();
5254
}
5355

5456
/**
55-
* @NoAdminRequired
5657
* @NoOutgoingFederatedSharingRequired
5758
*
5859
* @param integer $id
5960
* @return JSONResponse
6061
*/
62+
#[NoAdminRequired]
6163
public function destroy($id) {
6264
$this->externalManager->declineShare($id);
6365
return new JSONResponse();
@@ -93,13 +95,13 @@ protected function testUrl($remote, $checkVersion = false) {
9395
}
9496

9597
/**
96-
* @PublicPage
9798
* @NoOutgoingFederatedSharingRequired
9899
* @NoIncomingFederatedSharingRequired
99100
*
100101
* @param string $remote
101102
* @return DataResponse
102103
*/
104+
#[PublicPage]
103105
public function testRemote($remote) {
104106
if (str_contains($remote, '#') || str_contains($remote, '?') || str_contains($remote, ';')) {
105107
return new DataResponse(false);

‎apps/files_sharing/lib/Controller/PublicPreviewController.php‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
namespace OCA\Files_Sharing\Controller;
77

88
use OCP\AppFramework\Http;
9+
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
10+
use OCP\AppFramework\Http\Attribute\PublicPage;
911
use OCP\AppFramework\Http\DataResponse;
1012
use OCP\AppFramework\Http\FileDisplayResponse;
1113
use OCP\AppFramework\PublicShareController;
@@ -60,9 +62,6 @@ protected function isPasswordProtected(): bool {
6062

6163

6264
/**
63-
* @PublicPage
64-
* @NoCSRFRequired
65-
*
6665
* Get a preview for a shared file
6766
*
6867
* @param string $token Token of the share
@@ -77,6 +76,8 @@ protected function isPasswordProtected(): bool {
7776
* 403: Getting preview is not allowed
7877
* 404: Share or preview not found
7978
*/
79+
#[PublicPage]
80+
#[NoCSRFRequired]
8081
public function getPreview(
8182
string $token,
8283
string $file = '',
@@ -123,8 +124,6 @@ public function getPreview(
123124
}
124125

125126
/**
126-
* @PublicPage
127-
* @NoCSRFRequired
128127
* @NoSameSiteCookieRequired
129128
*
130129
* Get a direct link preview for a shared file
@@ -137,6 +136,8 @@ public function getPreview(
137136
* 403: Getting preview is not allowed
138137
* 404: Share or preview not found
139138
*/
139+
#[PublicPage]
140+
#[NoCSRFRequired]
140141
public function directLink(string $token) {
141142
// No token no image
142143
if ($token === '') {

‎apps/files_sharing/lib/Controller/RemoteController.php‎

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use OCA\Files_Sharing\External\Manager;
1010
use OCA\Files_Sharing\ResponseDefinitions;
1111
use OCP\AppFramework\Http;
12+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
1213
use OCP\AppFramework\Http\DataResponse;
1314
use OCP\AppFramework\OCS\OCSForbiddenException;
1415
use OCP\AppFramework\OCS\OCSNotFoundException;
@@ -21,8 +22,6 @@
2122
*/
2223
class RemoteController extends OCSController {
2324
/**
24-
* @NoAdminRequired
25-
*
2625
* Remote constructor.
2726
*
2827
* @param string $appName
@@ -39,21 +38,18 @@ public function __construct(
3938
}
4039

4140
/**
42-
* @NoAdminRequired
43-
*
4441
* Get list of pending remote shares
4542
*
4643
* @return DataResponse<Http::STATUS_OK, Files_SharingRemoteShare[], array{}>
4744
*
4845
* 200: Pending remote shares returned
4946
*/
47+
#[NoAdminRequired]
5048
public function getOpenShares() {
5149
return new DataResponse($this->externalManager->getOpenShares());
5250
}
5351

5452
/**
55-
* @NoAdminRequired
56-
*
5753
* Accept a remote share
5854
*
5955
* @param int $id ID of the share
@@ -62,6 +58,7 @@ public function getOpenShares() {
6258
*
6359
* 200: Share accepted successfully
6460
*/
61+
#[NoAdminRequired]
6562
public function acceptShare($id) {
6663
if ($this->externalManager->acceptShare($id)) {
6764
return new DataResponse();
@@ -74,8 +71,6 @@ public function acceptShare($id) {
7471
}
7572

7673
/**
77-
* @NoAdminRequired
78-
*
7974
* Decline a remote share
8075
*
8176
* @param int $id ID of the share
@@ -84,6 +79,7 @@ public function acceptShare($id) {
8479
*
8580
* 200: Share declined successfully
8681
*/
82+
#[NoAdminRequired]
8783
public function declineShare($id) {
8884
if ($this->externalManager->declineShare($id)) {
8985
return new DataResponse();
@@ -117,14 +113,13 @@ private static function extendShareInfo($share) {
117113
}
118114

119115
/**
120-
* @NoAdminRequired
121-
*
122116
* Get a list of accepted remote shares
123117
*
124118
* @return DataResponse<Http::STATUS_OK, Files_SharingRemoteShare[], array{}>
125119
*
126120
* 200: Accepted remote shares returned
127121
*/
122+
#[NoAdminRequired]
128123
public function getShares() {
129124
$shares = $this->externalManager->getAcceptedShares();
130125
$shares = array_map('self::extendShareInfo', $shares);
@@ -133,8 +128,6 @@ public function getShares() {
133128
}
134129

135130
/**
136-
* @NoAdminRequired
137-
*
138131
* Get info of a remote share
139132
*
140133
* @param int $id ID of the share
@@ -143,6 +136,7 @@ public function getShares() {
143136
*
144137
* 200: Share returned
145138
*/
139+
#[NoAdminRequired]
146140
public function getShare($id) {
147141
$shareInfo = $this->externalManager->getShare($id);
148142

@@ -155,8 +149,6 @@ public function getShare($id) {
155149
}
156150

157151
/**
158-
* @NoAdminRequired
159-
*
160152
* Unshare a remote share
161153
*
162154
* @param int $id ID of the share
@@ -166,6 +158,7 @@ public function getShare($id) {
166158
*
167159
* 200: Share unshared successfully
168160
*/
161+
#[NoAdminRequired]
169162
public function unshare($id) {
170163
$shareInfo = $this->externalManager->getShare($id);
171164

‎apps/files_sharing/lib/Controller/SettingsController.php‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111
use OCA\Files_Sharing\AppInfo\Application;
1212
use OCP\AppFramework\Controller;
13+
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
1314
use OCP\AppFramework\Http\JSONResponse;
1415
use OCP\IConfig;
1516
use OCP\IRequest;
@@ -31,25 +32,19 @@ public function __construct(IRequest $request,
3132
$this->userId = $userId;
3233
}
3334

34-
/**
35-
* @NoAdminRequired
36-
*/
35+
#[NoAdminRequired]
3736
public function setDefaultAccept(bool $accept): JSONResponse {
3837
$this->config->setUserValue($this->userId, Application::APP_ID, 'default_accept', $accept ? 'yes' : 'no');
3938
return new JSONResponse();
4039
}
4140

42-
/**
43-
* @NoAdminRequired
44-
*/
41+
#[NoAdminRequired]
4542
public function setUserShareFolder(string $shareFolder): JSONResponse {
4643
$this->config->setUserValue($this->userId, Application::APP_ID, 'share_folder', $shareFolder);
4744
return new JSONResponse();
4845
}
4946

50-
/**
51-
* @NoAdminRequired
52-
*/
47+
#[NoAdminRequired]
5348
public function resetUserShareFolder(): JSONResponse {
5449
$this->config->deleteUserValue($this->userId, Application::APP_ID, 'share_folder');
5550
return new JSONResponse();

0 commit comments

Comments
 (0)