checking download attribute to download (Fix #687)

ONLYOFFICE · Sep 9, 2022 · 2fac82e · 2fac82e
1 parent 540eff4
commit 2fac82e
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/controller/editorcontroller.php b/controller/editorcontroller.php
@@ -1048,6 +1048,17 @@ public function download($fileId, $toExtension = null, $template = false) {
             }
         }
 
+        $fileStorage = $file->getStorage();
+        if ($fileStorage->instanceOfStorage("\OCA\Files_Sharing\SharedStorage")) {
+            if (method_exists(IShare::class, "getAttributes")) {
+                $share = empty($share) ? $fileStorage->getShare() : $share;
+                $attributes = $share->getAttributes();
+                if ($attributes !== null && !$attributes->getAttribute("permissions", "download")) {
+                    return $this->renderError($this->trans->t("Not permitted"));
+                }
+            }
+        }
+
         $fileName = $file->getName();
         $ext = strtolower(pathinfo($fileName, PATHINFO_EXTENSION));
         $toExtension = strtolower($toExtension);