fix: Check for update permissions when creating a new file

Signed-off-by: Julius Härtl <[email protected]>
nextcloud · Oct 16, 2024 · d0b6ad1 · d0b6ad1
1 parent 3a53888
commit d0b6ad1
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/lib/Controller/DocumentAPIController.php b/lib/Controller/DocumentAPIController.php
@@ -72,6 +72,12 @@ public function create(string $mimeType, string $fileName, string $directoryPath
 		try {
 			if ($shareToken !== null) {
 				$share = $this->shareManager->getShareByToken($shareToken);
+				if (!($share->getPermissions() & \OCP\Constants::PERMISSION_CREATE)) {
+					return new JSONResponse([
+						'status' => 'error',
+						'message' => $this->l10n->t('Not allowed to create document')
+					], Http::STATUS_FORBIDDEN);
+				}
 			}
 
 			$rootFolder = $shareToken !== null ? $share->getNode() : $this->rootFolder->getUserFolder($this->userId);