only allow empty permissions for links

Signed-off-by: jkoberg <jkoberg@owncloud.com>

internal/http/services/owncloud/ocs/conversions/permissions.go

@@ -19,6 +19,7 @@
 package conversions
 
 import (
+	"errors"
 	"fmt"
 	"strconv"
 )
@@ -50,13 +51,15 @@ const (
 var (
 	// ErrPermissionNotInRange defines a permission specific error.
 	ErrPermissionNotInRange = fmt.Errorf("The provided permission is not between %d and %d", PermissionMinInput, PermissionMaxInput)
+	// ErrZeroPermission defines a permission specific error
+	ErrZeroPermission = errors.New("permission is zero")
 )
 
 // NewPermissions creates a new Permissions instance.
 // The value must be in the valid range.
 func NewPermissions(val int) (Permissions, error) {
 	if val == int(PermissionInvalid) {
-		return PermissionInvalid, nil
+		return PermissionInvalid, ErrZeroPermission
 	} else if val < int(PermissionInvalid) || int(PermissionMaxInput) < val {
 		return PermissionInvalid, ErrPermissionNotInRange
 	}

internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go

@@ -529,7 +529,7 @@ func ocPublicPermToCs3(permKey int, h *Handler) (*provider.ResourcePermissions,
 	}
 
 	perm, err := conversions.NewPermissions(permKey)
-	if err != nil {
+	if err != nil && err != conversions.ErrZeroPermission { // we allow empty permissions for public links
 		return nil, err
 	}
 

internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go

@@ -292,7 +292,7 @@ func (h *Handler) CreateShare(w http.ResponseWriter, r *http.Request) {
 	case int(conversions.ShareTypePublicLink):
 		// public links default to read only
 		_, _, ocsErr := h.extractPermissions(reqRole, reqPermissions, statRes.Info, conversions.NewViewerRole())
-		if ocsErr != nil {
+		if ocsErr != nil && ocsErr.Error != conversions.ErrZeroPermission {
 			response.WriteOCSError(w, r, http.StatusNotFound, "No share permission", nil)
 			return
 		}