Merge pull request #7193 from nextcloud/backport/7191/stable30

[stable30] fix: Apply storage checks in addition to share

Author: mejo-

lib/Service/AttachmentService.php

@@ -393,8 +393,9 @@ private function hasUpdatePermissions(string $shareToken): bool {
 					[IShare::TYPE_LINK, IShare::TYPE_EMAIL, IShare::TYPE_ROOM],
 					true
 				)
-				&& $share->getPermissions() & Constants::PERMISSION_UPDATE);
-		} catch (ShareNotFound $e) {
+				&& $share->getPermissions() & Constants::PERMISSION_UPDATE
+				&& $share->getNode()->getPermissions() & Constants::PERMISSION_UPDATE);
+		} catch (ShareNotFound|NotFoundException $e) {
 			return false;
 		}
 	}

lib/Service/DocumentService.php

@@ -614,7 +614,7 @@ public function checkSharePermissions(string $shareToken, int $permission = Cons
 			throw new NotFoundException();
 		}
 
-		if (($share->getPermissions() & $permission) === 0) {
+		if (($share->getPermissions() & $permission) === 0 || ($share->getNode()->getPermissions() & $permission) === 0) {
 			throw new NotFoundException();
 		}
 	}