From cfca01c52d59c4c6dff19bb5e1dc73a22f88f94a Mon Sep 17 00:00:00 2001
From: Robin Appelman <robin@icewind.nl>
Date: Wed, 22 Jul 2026 20:31:13 +0200
Subject: [PATCH] fix: disable direct link if link shares are disabled

Signed-off-by: Robin Appelman <robin@icewind.nl>
---
 apps/dav/lib/Controller/DirectController.php  |  6 ++++
 .../unit/Controller/DirectControllerTest.php  | 35 ++++++++++++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/apps/dav/lib/Controller/DirectController.php b/apps/dav/lib/Controller/DirectController.php
index ea209168123ac..50b4d6eb70cfb 100644
--- a/apps/dav/lib/Controller/DirectController.php
+++ b/apps/dav/lib/Controller/DirectController.php
@@ -25,6 +25,7 @@
 use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\Security\ISecureRandom;
+use OCP\Share\IManager;
 
 class DirectController extends OCSController {
 
@@ -38,6 +39,7 @@ public function __construct(
 		private ITimeFactory $timeFactory,
 		private IURLGenerator $urlGenerator,
 		private IEventDispatcher $eventDispatcher,
+		private IManager $shareManager,
 	) {
 		parent::__construct($appName, $request);
 	}
@@ -56,6 +58,10 @@ public function __construct(
 	 */
 	#[NoAdminRequired]
 	public function getUrl(int $fileId, int $expirationTime = 60 * 60 * 8): DataResponse {
+		if (!$this->shareManager->shareApiAllowLinks()) {
+			throw new OCSForbiddenException('Creating direct links is disabled');
+		}
+
 		$userFolder = $this->rootFolder->getUserFolder($this->userId);
 
 		$file = $userFolder->getFirstNodeById($fileId);
diff --git a/apps/dav/tests/unit/Controller/DirectControllerTest.php b/apps/dav/tests/unit/Controller/DirectControllerTest.php
index 837adde1da7fd..09bcf52d86656 100644
--- a/apps/dav/tests/unit/Controller/DirectControllerTest.php
+++ b/apps/dav/tests/unit/Controller/DirectControllerTest.php
@@ -13,6 +13,7 @@
 use OCA\DAV\Db\DirectMapper;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCS\OCSBadRequestException;
+use OCP\AppFramework\OCS\OCSForbiddenException;
 use OCP\AppFramework\OCS\OCSNotFoundException;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\EventDispatcher\IEventDispatcher;
@@ -22,6 +23,7 @@
 use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\Security\ISecureRandom;
+use OCP\Share\IManager;
 use PHPUnit\Framework\MockObject\MockObject;
 use Test\TestCase;
 
@@ -32,6 +34,7 @@ class DirectControllerTest extends TestCase {
 	private ITimeFactory&MockObject $timeFactory;
 	private IURLGenerator&MockObject $urlGenerator;
 	private IEventDispatcher&MockObject $eventDispatcher;
+	private IManager&MockObject $shareManager;
 
 	private DirectController $controller;
 
@@ -44,6 +47,7 @@ protected function setUp(): void {
 		$this->timeFactory = $this->createMock(ITimeFactory::class);
 		$this->urlGenerator = $this->createMock(IURLGenerator::class);
 		$this->eventDispatcher = $this->createMock(IEventDispatcher::class);
+		$this->shareManager = $this->createMock(IManager::class);
 
 		$this->controller = new DirectController(
 			'dav',
@@ -54,11 +58,15 @@ protected function setUp(): void {
 			$this->random,
 			$this->timeFactory,
 			$this->urlGenerator,
-			$this->eventDispatcher
+			$this->eventDispatcher,
+			$this->shareManager,
 		);
 	}
 
 	public function testGetUrlNonExistingFileId(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(true);
+
 		$userFolder = $this->createMock(Folder::class);
 		$this->rootFolder->method('getUserFolder')
 			->with('awesomeUser')
@@ -73,6 +81,9 @@ public function testGetUrlNonExistingFileId(): void {
 	}
 
 	public function testGetUrlForFolder(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(true);
+
 		$userFolder = $this->createMock(Folder::class);
 		$this->rootFolder->method('getUserFolder')
 			->with('awesomeUser')
@@ -89,6 +100,9 @@ public function testGetUrlForFolder(): void {
 	}
 
 	public function testGetUrlValid(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(true);
+
 		$userFolder = $this->createMock(Folder::class);
 		$this->rootFolder->method('getUserFolder')
 			->with('awesomeUser')
@@ -135,4 +149,23 @@ public function testGetUrlValid(): void {
 			'url' => 'https://my.nextcloud/remote.php/direct/superduperlongtoken',
 		], $result->getData());
 	}
+
+	public function testGetUrlNoLinkShares(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(false);
+
+		$userFolder = $this->createMock(Folder::class);
+		$this->rootFolder->method('getUserFolder')
+			->with('awesomeUser')
+			->willReturn($userFolder);
+
+		$file = $this->createMock(File::class);
+
+		$userFolder->method('getFirstNodeById')
+			->with(101)
+			->willReturn($file);
+
+		$this->expectException(OCSForbiddenException::class);
+		$this->controller->getUrl(101);
+	}
 }