diff --git a/apps/dav/lib/Controller/DirectController.php b/apps/dav/lib/Controller/DirectController.php index 531b6bd2d0014..d209800ccabc5 100644 --- a/apps/dav/lib/Controller/DirectController.php +++ b/apps/dav/lib/Controller/DirectController.php @@ -26,6 +26,7 @@ use OCP\IRequest; use OCP\IURLGenerator; use OCP\Security\ISecureRandom; +use OCP\Share\IManager; class DirectController extends OCSController { @@ -39,6 +40,7 @@ public function __construct( private ITimeFactory $timeFactory, private IURLGenerator $urlGenerator, private IEventDispatcher $eventDispatcher, + private IManager $shareManager, ) { parent::__construct($appName, $request); } @@ -57,6 +59,10 @@ public function __construct( */ #[NoAdminRequired] public function getUrl(int $fileId, int $expirationTime = 60 * 60 * 8): DataResponse { + if (!$this->shareManager->shareApiAllowLinks()) { + throw new OCSForbiddenException('Creating direct links is disabled'); + } + $userFolder = $this->rootFolder->getUserFolder($this->userId); $file = $userFolder->getFirstNodeById($fileId); diff --git a/apps/dav/tests/unit/Controller/DirectControllerTest.php b/apps/dav/tests/unit/Controller/DirectControllerTest.php index dcaa3c4a3a5f0..c32e648ba7f93 100644 --- a/apps/dav/tests/unit/Controller/DirectControllerTest.php +++ b/apps/dav/tests/unit/Controller/DirectControllerTest.php @@ -14,6 +14,7 @@ use OCA\DAV\Db\DirectMapper; use OCP\AppFramework\Http\DataResponse; use OCP\AppFramework\OCS\OCSBadRequestException; +use OCP\AppFramework\OCS\OCSForbiddenException; use OCP\AppFramework\OCS\OCSNotFoundException; use OCP\AppFramework\Utility\ITimeFactory; use OCP\EventDispatcher\IEventDispatcher; @@ -23,6 +24,7 @@ use OCP\IRequest; use OCP\IURLGenerator; use OCP\Security\ISecureRandom; +use OCP\Share\IManager; use PHPUnit\Framework\MockObject\MockObject; use Test\TestCase; @@ -33,6 +35,7 @@ class DirectControllerTest extends TestCase { private ITimeFactory&MockObject $timeFactory; private IURLGenerator&MockObject $urlGenerator; private IEventDispatcher&MockObject $eventDispatcher; + private IManager&MockObject $shareManager; private DirectController $controller; @@ -45,6 +48,7 @@ protected function setUp(): void { $this->timeFactory = $this->createMock(ITimeFactory::class); $this->urlGenerator = $this->createMock(IURLGenerator::class); $this->eventDispatcher = $this->createMock(IEventDispatcher::class); + $this->shareManager = $this->createMock(IManager::class); $this->controller = new DirectController( 'dav', @@ -55,11 +59,15 @@ protected function setUp(): void { $this->random, $this->timeFactory, $this->urlGenerator, - $this->eventDispatcher + $this->eventDispatcher, + $this->shareManager, ); } public function testGetUrlNonExistingFileId(): void { + $this->shareManager->method('shareApiAllowLinks') + ->willReturn(true); + $userFolder = $this->createMock(Folder::class); $this->rootFolder->method('getUserFolder') ->with('awesomeUser') @@ -74,6 +82,9 @@ public function testGetUrlNonExistingFileId(): void { } public function testGetUrlForFolder(): void { + $this->shareManager->method('shareApiAllowLinks') + ->willReturn(true); + $userFolder = $this->createMock(Folder::class); $this->rootFolder->method('getUserFolder') ->with('awesomeUser') @@ -90,6 +101,9 @@ public function testGetUrlForFolder(): void { } public function testGetUrlValid(): void { + $this->shareManager->method('shareApiAllowLinks') + ->willReturn(true); + $userFolder = $this->createMock(Folder::class); $this->rootFolder->method('getUserFolder') ->with('awesomeUser') @@ -136,4 +150,23 @@ public function testGetUrlValid(): void { 'url' => 'https://my.nextcloud/remote.php/direct/superduperlongtoken', ], $result->getData()); } + + public function testGetUrlNoLinkShares(): void { + $this->shareManager->method('shareApiAllowLinks') + ->willReturn(false); + + $userFolder = $this->createMock(Folder::class); + $this->rootFolder->method('getUserFolder') + ->with('awesomeUser') + ->willReturn($userFolder); + + $file = $this->createMock(File::class); + + $userFolder->method('getFirstNodeById') + ->with(101) + ->willReturn($file); + + $this->expectException(OCSForbiddenException::class); + $this->controller->getUrl(101); + } }