From a175fff268152b756a7640f01f0ac95a9f830872 Mon Sep 17 00:00:00 2001 From: provokateurin Date: Thu, 26 Sep 2024 16:34:45 +0200 Subject: [PATCH] fix(TrashBackend): Fix delete checks Signed-off-by: provokateurin --- lib/Trash/TrashBackend.php | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/lib/Trash/TrashBackend.php b/lib/Trash/TrashBackend.php index fab6a2100..ba63eb9bc 100644 --- a/lib/Trash/TrashBackend.php +++ b/lib/Trash/TrashBackend.php @@ -197,13 +197,20 @@ public function removeItem(ITrashItem $item) { if ($node === null) { throw new NotFoundException(); } - if ($node->getStorage()->unlink($node->getInternalPath()) === false) { - throw new \Exception('Failed to remove item from trashbin'); - } + if (!$this->userHasAccessToPath($item->getUser(), $item->getPath(), Constants::PERMISSION_DELETE)) { throw new NotPermittedException(); } + $folderPermissions = $this->folderManager->getFolderPermissionsForUser($item->getUser(), (int)$folderId); + if (($folderPermissions & Constants::PERMISSION_DELETE) !== Constants::PERMISSION_DELETE) { + throw new NotPermittedException(); + } + + if ($node->getStorage()->unlink($node->getInternalPath()) === false) { + throw new \Exception('Failed to remove item from trashbin'); + } + $node->getStorage()->getCache()->remove($node->getInternalPath()); if ($item->isRootItem()) { $this->trashManager->removeItem((int)$folderId, $item->getName(), $item->getDeletedTime());