From c2fcce2e14e866f56c4f6c034a932c6260abf8f5 Mon Sep 17 00:00:00 2001 From: Bjoern Schiessle Date: Thu, 16 Feb 2017 15:35:19 +0100 Subject: [PATCH 1/3] provide api to convert link to mail share Signed-off-by: Bjoern Schiessle --- core/Controller/LegacyShareController.php | 109 ++++++++++++++++++++++ core/routes.php | 1 + 2 files changed, 110 insertions(+) create mode 100644 core/Controller/LegacyShareController.php diff --git a/core/Controller/LegacyShareController.php b/core/Controller/LegacyShareController.php new file mode 100644 index 0000000000000..907cac61e908e --- /dev/null +++ b/core/Controller/LegacyShareController.php @@ -0,0 +1,109 @@ + + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + + +namespace OC\Core\Controller; + + +use OCP\AppFramework\Controller; +use OCP\AppFramework\Http; +use OCP\AppFramework\Http\JSONResponse; +use OCP\IRequest; +use OCP\Share\IManager; + +/** + * Class LegacyShareController + * + * Implements a ajax call to send a link share by mail by creating a dedicated mail + * share + * + * This class is used to stay compatible with the ownCloud sync client. + * Can be removed as soon as compatibility is no longer required + * + * @package OC\Core\Controller + */ +class LegacyShareController extends Controller { + + /** @var IManager */ + private $shareManager; + + /** + * LegacyShareController constructor. + * + * @param string $appName + * @param IRequest $request + * @param IManager $shareManager + */ + public function __construct($appName, IRequest $request, IManager $shareManager) { + parent::__construct($appName, $request); + $this->shareManager = $shareManager; + } + + /** + * @param string $action + * @param string $toaddress + * @param string $link + * @return JSONResponse + */ + public function link2Mail($action, $toaddress, $link) { + if ($action !== 'email') { + return new JSONResponse([], Http::STATUS_GONE); + } + + $recipients = $this->getEmailAddresses($toaddress); + + try { + $token = $this->getTokenFromUrl($link); + $share = $this->shareManager->getShareByToken($token); + $share->setShareType(\OCP\Share::SHARE_TYPE_EMAIL); + foreach ($recipients as $to) { + $share->setSharedWith($to); + $this->shareManager->createShare($share); + } + } catch (\Exception $e) { + return new JSONResponse(['data' => ['message' => 'Failed to send link by mail']], Http::STATUS_BAD_REQUEST); + } + return new JSONResponse(); + } + + /** + * exctract token from url + * + * @param string $url + * @return string + */ + protected function getTokenFromUrl($url) { + $start = strrpos($url, '/') + 1; + $token = substr($url, $start); + return $token; + } + + /** + * seperate multiple email addresses by ',' + * + * @param string $addresses + * @return array + */ + protected function getEmailAddresses($addresses) { + return explode(',' , $addresses); + } + +} diff --git a/core/routes.php b/core/routes.php index 5d61d58e03795..cb64a72855b0f 100644 --- a/core/routes.php +++ b/core/routes.php @@ -56,6 +56,7 @@ ['name' => 'Preview#getPreview', 'url' => '/core/preview', 'verb' => 'GET'], ['name' => 'Preview#getPreview', 'url' => '/core/preview.png', 'verb' => 'GET'], ['name' => 'Css#getCss', 'url' => '/css/{appName}/{fileName}', 'verb' => 'GET'], + ['name' => 'LegacyShare#link2Mail', 'url' => '/core/ajax/share.php', 'verb' => 'POST'], ], 'ocs' => [ ['root' => '/cloud', 'name' => 'OCS#getCapabilities', 'url' => '/capabilities', 'verb' => 'GET'], From b7382441bb68c5be4d1bb8cf2f8fce4645249a69 Mon Sep 17 00:00:00 2001 From: Bjoern Schiessle Date: Fri, 17 Feb 2017 12:26:33 +0100 Subject: [PATCH 2/3] check if the user is allowed to send the share my mail Signed-off-by: Bjoern Schiessle --- core/Controller/LegacyShareController.php | 38 +++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/core/Controller/LegacyShareController.php b/core/Controller/LegacyShareController.php index 907cac61e908e..49e3af8a1c15f 100644 --- a/core/Controller/LegacyShareController.php +++ b/core/Controller/LegacyShareController.php @@ -27,7 +27,10 @@ use OCP\AppFramework\Http; use OCP\AppFramework\Http\JSONResponse; use OCP\IRequest; +use OCP\IUserSession; +use OCP\Share; use OCP\Share\IManager; +use OCP\Share\IShare; /** * Class LegacyShareController @@ -45,16 +48,23 @@ class LegacyShareController extends Controller { /** @var IManager */ private $shareManager; + /** @var IUserSession */ + private $userSession; + /** * LegacyShareController constructor. * * @param string $appName * @param IRequest $request * @param IManager $shareManager + * @param IUserSession $userSession */ - public function __construct($appName, IRequest $request, IManager $shareManager) { + public function __construct($appName, IRequest $request, + IManager $shareManager, + IUserSession $userSession) { parent::__construct($appName, $request); $this->shareManager = $shareManager; + $this->userSession = $userSession; } /** @@ -73,7 +83,8 @@ public function link2Mail($action, $toaddress, $link) { try { $token = $this->getTokenFromUrl($link); $share = $this->shareManager->getShareByToken($token); - $share->setShareType(\OCP\Share::SHARE_TYPE_EMAIL); + $this->checkPermissions($share); + $share->setShareType(Share::SHARE_TYPE_EMAIL); foreach ($recipients as $to) { $share->setSharedWith($to); $this->shareManager->createShare($share); @@ -106,4 +117,27 @@ protected function getEmailAddresses($addresses) { return explode(',' , $addresses); } + /** + * check if the user has enough permission to send the share by mail + * + * @param IShare $share + * @return bool + * @throws \Exception + */ + protected function checkPermissions(IShare $share) { + $currentUser = $this->userSession->getUser(); + + if ($currentUser === null) { + throw new \Exception('no Permission to send share my mail'); + } + + $uid = $currentUser->getUID(); + + if ($share->getShareOwner() === $uid || $share->getSharedBy() === $uid) { + return true; + } + + throw new \Exception('no Permission to send share my mail'); + } + } From 9fd84063f6c204583c9cd8e3234777926699ed8d Mon Sep 17 00:00:00 2001 From: Bjoern Schiessle Date: Fri, 17 Feb 2017 12:30:35 +0100 Subject: [PATCH 3/3] also normal users should be able to call the API Signed-off-by: Bjoern Schiessle --- core/Controller/LegacyShareController.php | 1 + 1 file changed, 1 insertion(+) diff --git a/core/Controller/LegacyShareController.php b/core/Controller/LegacyShareController.php index 49e3af8a1c15f..4b1c98ec26073 100644 --- a/core/Controller/LegacyShareController.php +++ b/core/Controller/LegacyShareController.php @@ -68,6 +68,7 @@ public function __construct($appName, IRequest $request, } /** + * @NoAdminRequired * @param string $action * @param string $toaddress * @param string $link