From 2fac82e4e17ff4ea1efef56d7a5885cbdca26365 Mon Sep 17 00:00:00 2001
From: Antipkin-A <Artem.Antipkin@onlyoffice.com>
Date: Fri, 9 Sep 2022 13:29:41 +0300
Subject: [PATCH] checking download attribute to download (Fix #687)

---
 controller/editorcontroller.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/controller/editorcontroller.php b/controller/editorcontroller.php
index 80b25d3d..92e7b60f 100644
--- a/controller/editorcontroller.php
+++ b/controller/editorcontroller.php
@@ -1048,6 +1048,17 @@ public function download($fileId, $toExtension = null, $template = false) {
             }
         }
 
+        $fileStorage = $file->getStorage();
+        if ($fileStorage->instanceOfStorage("\OCA\Files_Sharing\SharedStorage")) {
+            if (method_exists(IShare::class, "getAttributes")) {
+                $share = empty($share) ? $fileStorage->getShare() : $share;
+                $attributes = $share->getAttributes();
+                if ($attributes !== null && !$attributes->getAttribute("permissions", "download")) {
+                    return $this->renderError($this->trans->t("Not permitted"));
+                }
+            }
+        }
+
         $fileName = $file->getName();
         $ext = strtolower(pathinfo($fileName, PATHINFO_EXTENSION));
         $toExtension = strtolower($toExtension);