Allow public link sharing only for certain groups

apps/files_sharing/appinfo/app.php

@@ -27,6 +27,8 @@
  *
  */
 
+use OCP\Util;
+
 \OCA\Files_Sharing\Helper::registerHooks();
 
 \OCP\Share::registerBackend('file', 'OCA\Files_Sharing\ShareBackend\File');
@@ -44,6 +46,7 @@
 	function () {
 		\OCP\Util::addScript('files_sharing', 'share');
 		\OCP\Util::addScript('files_sharing', 'sharetabview');
+		\OCP\Util::addScript('files_sharing', 'sharedialogview');
 		if (\OC::$server->getConfig()->getAppValue('files_sharing', 'incoming_server2server_share_enabled', 'yes') === 'yes') {
 			\OCP\Util::addScript('files_sharing', 'external');
 		}

apps/files_sharing/js/settings.js

@@ -16,4 +16,22 @@ $(document).ready(function() {
 		groups = JSON.stringify(groups);
 		OC.AppConfig.setValue('files_sharing', $(this).attr('name'), groups);
 	});
+
+	var $publicShareSharersGroupsAllowlist = $('input[name="public_share_sharers_groups_allowlist"]');
+	var $publicShareSharersGroupsAllowlistEnabled = $('#publicShareSharersGroupsAllowlistEnabled');
+	OC.Settings.setupGroupsSelect($publicShareSharersGroupsAllowlist);
+
+	$publicShareSharersGroupsAllowlist.change(function(ev) {
+		var groups = ev.val || [];
+		groups = JSON.stringify(groups);
+		OC.AppConfig.setValue('files_sharing', 'public_share_sharers_groups_allowlist', groups);
+
+	});
+	$publicShareSharersGroupsAllowlistEnabled.change(function() {
+		$("#setAllowlistPublicShareSharersGroups").toggleClass('hidden', !this.checked);
+		OC.AppConfig.setValue('files_sharing', 'public_share_sharers_groups_allowlist_enabled', this.checked ? 'yes' : 'no');
+
+	});
+	// Move setting to sharing section
+	$publicShareSharersGroupsAllowlist.closest('p').detach().insertAfter($('#selectExcludedGroups').closest('p'));
 });

apps/files_sharing/js/sharedialogview.js

@@ -0,0 +1,102 @@
+/**
+ * @author Jan Ackermann <jackermann@owncloud.com>
+ *
+ * @copyright Copyright (c) 2021, ownCloud GmbH
+ * @license AGPL-3.0
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+(function() {
+	if (!OCA.Sharing) {
+		OCA.Sharing = {};
+	}
+
+	/**
+	 * @namespace
+	 */
+	OCA.Sharing.ShareDialogView = {
+		attach: function (view) {
+			var that = this;
+			var baseRenderCall = view.render;
+
+			var shareCollectionModel = view.model.getLinkSharesCollection();
+			view.linkShareView = new OC.Share.ShareDialogLinkListView({
+				collection: shareCollectionModel,
+				itemModel: view.model
+			});
+
+			var baseLinkShareViewRender = view.linkShareView.render;
+
+			view.render = function () {
+				baseRenderCall.call(view);
+				if (that.isPublicSharingBlockedByAllowlist() && !shareCollectionModel.length) {
+					view.$el.find('.subtab-publicshare').remove();
+				}
+			};
+
+			view.linkShareView.render = function () {
+				baseLinkShareViewRender.call(view.linkShareView);
+
+				if (that.isPublicSharingBlockedByAllowlist()) {
+					view.linkShareView.$el.find('.addLink').remove();
+					view.$el.find('.empty-message').remove();
+				}
+			};
+
+			var baseShareeListViewRender = view.shareeListView.render;
+
+			var linkShareViewInitialized = false;
+			view.shareeListView.render = function () {
+				baseShareeListViewRender.call(view.shareeListView);
+
+				view.$el.find(".subTabHeader.subtab-publicshare").on("click", function () {
+					if (linkShareViewInitialized) {
+						return;
+					}
+
+					view.linkShareView.render();
+					view.$('.linkListView').html(view.linkShareView.$el);
+					linkShareViewInitialized = true;
+				});
+
+			};
+		},
+
+		isPublicSharingBlockedByAllowlist: function () {
+			var allowlistEnabled = oc_appconfig.files_sharing.publicShareSharersGroupsAllowlistEnabled;
+			var allowlistGroups = oc_appconfig.files_sharing.publicShareSharersGroupsAllowlist;
+
+
+			if (allowlistEnabled === true &&
+				allowlistGroups.length
+			) {
+				var userGroups = OC.getCurrentUser().groups;
+
+				for (var i = 0; i < userGroups.length; i++) {
+					if (allowlistGroups.indexOf(userGroups[i]) >= 0) {
+						return false;
+					}
+				}
+
+				return true;
+			}
+
+			return false;
+		}
+	};
+})();
+
+OC.Plugins.register('OC.Share.ShareDialogView', OCA.Sharing.ShareDialogView);

apps/files_sharing/lib/AppInfo/Application.php

@@ -38,6 +38,7 @@
 use OCA\Files_Sharing\MountProvider;
 use OCA\Files_Sharing\Notifier;
 use OCA\Files_Sharing\SharingBlacklist;
+use OCA\Files_Sharing\SharingAllowlist;
 use OCP\AppFramework\App;
 use OCP\IContainer;
 use OCA\Files_Sharing\Hooks;
@@ -97,7 +98,8 @@ public function __construct(array $urlParams = []) {
 				$server->getConfig(),
 				$c->query(NotificationPublisher::class),
 				$server->getEventDispatcher(),
-				$c->query(SharingBlacklist::class)
+				$c->query(SharingBlacklist::class),
+				$c->query(SharingAllowlist::class)
 			);
 		});
 
@@ -182,6 +184,7 @@ function () use ($c) {
 				$c->getServer()->getShareManager(),
 				$c->query(NotificationPublisher::class),
 				$c->getServer()->getActivityManager(),
+				$c->query(SharingAllowlist::class),
 				$c->getServer()->getUserSession()
 			);
 		});

apps/files_sharing/lib/Capabilities.php

@@ -23,6 +23,7 @@
 use OCP\Capabilities\ICapability;
 use OCP\IConfig;
 use OCP\IL10N;
+use OCP\IUserSession;
 use OCP\Util\UserSearch;
 use OCP\Share\IManager;
 
@@ -43,20 +44,44 @@ class Capabilities implements ICapability {
 	 */
 	private $userSearch;
 
-	/** @var IL10N */
+	/**
+	 * @var IL10N
+	 */
 	private $l10n;
 
+	/**
+	 * @var SharingAllowlist
+	 */
+	private $sharingAllowlist;
+
+	/**
+	 * @var IUserSession
+	 */
+	private $userSession;
+
 	/**
 	 * Capabilities constructor.
 	 *
 	 * @param IConfig $config
 	 * @param UserSearch $userSearch
+	 * @param IL10N $l10n
+	 * @param SharingAllowlist $sharingAllowlist
+	 * @param IUserSession $userSession
 	 */
-	public function __construct(IManager $shareManager, IConfig $config, UserSearch $userSearch, IL10N $l10n) {
+	public function __construct(
+		IManager $shareManager,
+		IConfig $config,
+		UserSearch $userSearch,
+		IL10N $l10n,
+		SharingAllowlist $sharingAllowlist,
+		IUserSession $userSession
+	) {
 		$this->shareManager = $shareManager;
 		$this->config = $config;
 		$this->userSearch = $userSearch;
 		$this->l10n = $l10n;
+		$this->sharingAllowlist = $sharingAllowlist;
+		$this->userSession = $userSession;
 	}
 
 	/**
@@ -93,6 +118,7 @@ public function getCapabilities() {
 				$public['password']['enforced'] = $roPasswordEnforced || $rwPasswordEnforced || $woPasswordEnforced || $rwdPasswordEnforced;
 
 				$public['roles_api'] = true;
+				$public['can_create_public_link'] = true;
 
 				$public['expire_date'] = [];
 				$public['expire_date']['enabled'] = $this->config->getAppValue('core', 'shareapi_default_expire_date', 'no') === 'yes';
@@ -107,6 +133,12 @@ public function getCapabilities() {
 				$public['multiple'] = true;
 				$public['supports_upload_only'] = true;
 				$public['defaultPublicLinkShareName'] = $this->l10n->t('Public link');
+
+				if ($this->sharingAllowlist->isPublicShareSharersGroupsAllowlistEnabled() &&
+					! $this->sharingAllowlist->isUserInPublicShareSharersGroupsAllowlist($this->userSession->getUser())
+				) {
+					$public['can_create_public_link'] = false;
+				}
 			}
 			$res["public"] = $public;
 

apps/files_sharing/lib/Controller/Share20OcsController.php

@@ -23,6 +23,7 @@
 
 use Exception;
 use OC\Files\Filesystem;
+use OCA\Files_Sharing\SharingAllowlist;
 use OCP\Constants;
 use OC\OCS\Result;
 use OCP\AppFramework\OCSController;
@@ -79,9 +80,10 @@ class Share20OcsController extends OCSController {
 	private $notificationPublisher;
 	/** @var EventDispatcher  */
 	private $eventDispatcher;
-
 	/** @var SharingBlacklist */
 	private $sharingBlacklist;
+	/** @var SharingAllowlist */
+	private $sharingAllowlist;
 	/**
 	 * @var string
 	 */
@@ -103,7 +105,8 @@ public function __construct(
 		IConfig $config,
 		NotificationPublisher $notificationPublisher,
 		EventDispatcher $eventDispatcher,
-		SharingBlacklist $sharingBlacklist
+		SharingBlacklist $sharingBlacklist,
+		SharingAllowlist $sharingAllowlist
 	) {
 		parent::__construct($appName, $request);
 		$this->request = $request;
@@ -117,6 +120,7 @@ public function __construct(
 		$this->notificationPublisher = $notificationPublisher;
 		$this->eventDispatcher = $eventDispatcher;
 		$this->sharingBlacklist = $sharingBlacklist;
+		$this->sharingAllowlist = $sharingAllowlist;
 		$this->additionalInfoField = $this->config->getAppValue('core', 'user_additional_info_field', '');
 		$this->userSession = $userSession;
 	}
@@ -418,6 +422,7 @@ public function createShare() {
 		$shareWith = $this->request->getParam('shareWith', null);
 
 		$globalAutoAccept = $this->config->getAppValue('core', 'shareapi_auto_accept_share', 'yes') === 'yes';
+
 		if ($shareType === Share::SHARE_TYPE_USER) {
 			$userAutoAccept = false;
 			if ($globalAutoAccept) {
@@ -457,12 +462,17 @@ public function createShare() {
 				$share->setState(Share::STATE_PENDING);
 			}
 		} elseif ($shareType === Share::SHARE_TYPE_LINK) {
-			//Can we even share links?
 			if (!$this->shareManager->shareApiAllowLinks()) {
 				$share->getNode()->unlock(ILockingProvider::LOCK_SHARED);
 				return new Result(null, 404, $this->l->t('Public link sharing is disabled by the administrator'));
 			}
 
+			if ($this->sharingAllowlist->isPublicShareSharersGroupsAllowlistEnabled() &&
+				!$this->sharingAllowlist->isUserInPublicShareSharersGroupsAllowlist($this->userSession->getUser())
+			) {
+				return new Result(null, 403, $this->l->t('Public link creation is only possible for certain groups'));
+			}
+
 			// legacy way, expecting that this won't be used together with "create-only" shares
 			$publicUpload = $this->request->getParam('publicUpload', null);
 			// a few permission checks

apps/files_sharing/lib/Helper.php

@@ -41,6 +41,8 @@ public static function registerHooks() {
 		\OCP\Util::connectHook('OC_Filesystem', 'post_delete', '\OCA\Files_Sharing\Hooks', 'unshareChildren');
 
 		\OCP\Util::connectHook('OC_User', 'post_deleteUser', '\OCA\Files_Sharing\Hooks', 'deleteUser');
+
+		\OCP\Util::connectHook('\OCP\Config', 'js', '\OCA\Files_Sharing\Hooks', 'extendJsConfig');
 	}
 
 	/**

apps/files_sharing/lib/Hooks.php

@@ -66,6 +66,11 @@ class Hooks {
 	 */
 	private $notificationPublisher;
 
+	/**
+	 * @var SharingAllowlist
+	 */
+	private $sharingAllowlist;
+
 	/**
 	 * @var ActivityManager
 	 */
@@ -80,6 +85,7 @@ class Hooks {
 	 * @param \OCP\Share\IManager $shareManager
 	 * @param NotificationPublisher $notificationPublisher
 	 * @param ActivityManager $activityManager
+	 * @param SharingAllowlist $sharingAllowlist
 	 * @param IUserSession|null $userSession
 	 */
 	public function __construct(
@@ -89,6 +95,7 @@ public function __construct(
 		\OCP\Share\IManager $shareManager,
 		NotificationPublisher $notificationPublisher,
 		ActivityManager $activityManager,
+		SharingAllowlist $sharingAllowlist,
 		$userSession
 	) {
 		$this->userSession = $userSession;
@@ -98,6 +105,7 @@ public function __construct(
 		$this->shareManager = $shareManager;
 		$this->notificationPublisher = $notificationPublisher;
 		$this->activityManager = $activityManager;
+		$this->sharingAllowlist= $sharingAllowlist;
 	}
 
 	public static function deleteUser($params) {
@@ -223,6 +231,15 @@ function (GenericEvent $event) {
 				$this->activityManager->publish($activityEvent);
 			}
 		);
+
+		$this->eventDispatcher->addListener('group.postDelete', function ($event) {
+			$groupId = $event->getSubject()->getGID();
+			$groupsAllowlist =  $this->sharingAllowlist->getPublicShareSharersGroupsAllowlist();
+
+			if (\in_array($groupId, $groupsAllowlist)) {
+				$this->sharingAllowlist->setPublicShareSharersGroupsAllowlist(array_diff($groupsAllowlist, [$groupId]));
+			}
+		});
 	}
 
 	private function getCurrentUserUid() {
@@ -264,4 +281,18 @@ private function resolvePrivateLink($uid, $fileId) {
 
 		return null;
 	}
+
+	public static function extendJsConfig($array) {
+		$sharingAllowlist = new SharingAllowlist(
+			\OC::$server->getConfig(),
+			\OC::$server->getGroupManager()
+		);
+
+		$array['array']['oc_appconfig']['files_sharing'] = [
+			'publicShareSharersGroupsAllowlist' => $sharingAllowlist->getPublicShareSharersGroupsAllowlist(),
+			'publicShareSharersGroupsAllowlistEnabled' => $sharingAllowlist->isPublicShareSharersGroupsAllowlistEnabled(),
+		];
+
+		return $array;
+	}
 }