upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-11 09:42:09 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 57

Merge pull request #29521 from nextcloud/backport/29366/stable19

Browse source 
[stable19] Fix security issues when copying groupfolder with advanced ACL
This commit is contained in:
Lukas Reschke 2021-11-02 15:14:19 +01:00 committed by GitHub
commit fc947593e4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/private/Files/Storage/Local.php
View file

@ -513,7 +513,10 @@ class Local extends \OC\Files\Storage\Common {
* @return bool
*/
public function copyFromStorage(IStorage $sourceStorage, $sourceInternalPath, $targetInternalPath, $preserveMtime = false) {
if ($sourceStorage->instanceOfStorage(Local::class)) {
// Don't treat ACLStorageWrapper like local storage where copy can be done directly.
// Instead use the slower recursive copying in php from Common::copyFromStorage with
// more permissions checks.
if ($sourceStorage->instanceOfStorage(Local::class) && !$sourceStorage->instanceOfStorage('OCA\GroupFolders\ACL\ACLStorageWrapper')) {
if ($sourceStorage->instanceOfStorage(Jail::class)) {
/**
* @var \OC\Files\Storage\Wrapper\Jail $sourceStorage