fix Graph delete request leaks existence of space #5031

owncloud · May 3, 2023 · 0c13c0b · 0c13c0b
1 parent 8942400
commit 0c13c0b
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 4 deletions.
diff --git a/changelog/unreleased/fix-leaks-existence.md b/changelog/unreleased/fix-leaks-existence.md
@@ -0,0 +1,6 @@
+Bugfix: Hide the existence of space when deleting/updating
+
+The "code": "notAllowed" changed to "code": "itemNotFound"
+
+https://github.com/owncloud/ocis/issues/5031
+https://github.com/owncloud/ocis/pull/6220
diff --git a/services/graph/pkg/service/v0/drives.go b/services/graph/pkg/service/v0/drives.go
@@ -468,19 +468,19 @@ func (g Graph) UpdateDrive(w http.ResponseWriter, r *http.Request) {
 		switch resp.Status.GetCode() {
 		case cs3rpc.Code_CODE_NOT_FOUND:
 			logger.Debug().Interface("id", rid).Msg("could not update drive: drive not found")
-			errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, resp.GetStatus().GetMessage())
+			errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "drive not found")
 			return
 		case cs3rpc.Code_CODE_PERMISSION_DENIED:
 			logger.Debug().Interface("id", rid).Msg("could not update drive, permission denied")
-			errorcode.NotAllowed.Render(w, r, http.StatusForbidden, resp.GetStatus().GetMessage())
+			errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "drive not found")
 			return
 		case cs3rpc.Code_CODE_INVALID_ARGUMENT:
 			logger.Debug().Interface("id", rid).Msg("could not update drive, invalid argument")
 			errorcode.NotAllowed.Render(w, r, http.StatusBadRequest, resp.GetStatus().GetMessage())
 			return
 		default:
 			logger.Debug().Interface("id", rid).Str("grpc", resp.GetStatus().GetMessage()).Msg("could not update drive: grpc error")
-			errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, resp.GetStatus().GetMessage())
+			errorcode.GeneralException.Render(w, r, http.StatusInternalServerError, "grpc error")
 			return
 		}
 	}
@@ -1054,7 +1054,11 @@ func (g Graph) DeleteDrive(w http.ResponseWriter, r *http.Request) {
 		return
 	case cs3rpc.Code_CODE_PERMISSION_DENIED:
 		logger.Debug().Interface("id", rid).Msg("could not delete drive: permission denied")
-		errorcode.NotAllowed.Render(w, r, http.StatusForbidden, "permission denied to delete drive")
+		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "drive not found")
+		return
+	case cs3rpc.Code_CODE_NOT_FOUND:
+		logger.Debug().Interface("id", rid).Msg("could not delete drive: drive not found")
+		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "drive not found")
 		return
 	// don't expose internal error codes to the outside world
 	default: