Merge pull request #3636 from nextcloud/backport/3635/stable24

[stable24] fix: Block incompatible operations with remote tokens
nextcloud · May 17, 2024 · 4d2bc09 · 4d2bc09
2 parents 27244ea + 3a72cc2
commit 4d2bc09
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
@@ -247,7 +247,7 @@ jobs:
         uses: "shivammathur/setup-php@v2"
         with:
           php-version: "${{ matrix.php-versions }}"
-          extensions: mbstring, iconv, fileinfo, intl, oci8
+          extensions: mbstring, iconv, fileinfo, intl, oci8, gd, zip
           tools: phpunit:9
           coverage: none
 

diff --git a/lib/Controller/WopiController.php b/lib/Controller/WopiController.php
@@ -202,11 +202,11 @@ public function checkFileInfo($fileId, $access_token) {
 			'UserFriendlyName' => $userDisplayName,
 			'UserExtraInfo' => [],
 			'UserCanWrite' => (bool)$wopi->getCanwrite(),
-			'UserCanNotWriteRelative' => $this->encryptionManager->isEnabled() || $isPublic || $wopi->getHideDownload(),
+			'UserCanNotWriteRelative' => $this->encryptionManager->isEnabled() || $isPublic || $wopi->getHideDownload() || $wopi->isRemoteToken(),
 			'PostMessageOrigin' => $wopi->getServerHost(),
 			'LastModifiedTime' => Helper::toISO8601($file->getMTime()),
-			'SupportsRename' => !$isVersion,
-			'UserCanRename' => !$isPublic && !$isVersion,
+			'SupportsRename' => !$isVersion && !$wopi->isRemoteToken(),
+			'UserCanRename' => !$isPublic && !$isVersion && !$wopi->isRemoteToken(),
 			'EnableInsertRemoteImage' => !$isPublic,
 			'EnableShare' => $file->isShareable() && !$isVersion && !$isPublic,
 			'HideUserList' => '',