From 5b7b972882c46f1e0c18c3e8adfed7b66e846896 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Thu, 21 Oct 2021 16:57:07 +0200 Subject: [PATCH] Fix security issues when copying groupfolder with advanced ACL Using advanced ACL, it is possible that an user has access to a directory but not to a subdirectory, so the copying use Common::copyFromStorage instead of Local::copyFromStorage. Fix https://github.com/nextcloud/groupfolders/issues/1692 Signed-off-by: Carl Schwan --- lib/private/Files/Storage/Local.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/private/Files/Storage/Local.php b/lib/private/Files/Storage/Local.php index 423de64acb1d9..fb7b33eb6dfeb 100644 --- a/lib/private/Files/Storage/Local.php +++ b/lib/private/Files/Storage/Local.php @@ -513,7 +513,10 @@ private function calculateEtag(string $path, array $stat): string { * @return bool */ public function copyFromStorage(IStorage $sourceStorage, $sourceInternalPath, $targetInternalPath, $preserveMtime = false) { - if ($sourceStorage->instanceOfStorage(Local::class)) { + // Don't treat ACLStorageWrapper like local storage where copy can be done directly. + // Instead use the slower recursive copying in php from Common::copyFromStorage with + // more permissions checks. + if ($sourceStorage->instanceOfStorage(Local::class) && !$sourceStorage->instanceOfStorage('OCA\GroupFolders\ACL\ACLStorageWrapper')) { if ($sourceStorage->instanceOfStorage(Jail::class)) { /** * @var \OC\Files\Storage\Wrapper\Jail $sourceStorage