Skip to content

Conversation

@blizzz
Copy link
Member

@blizzz blizzz commented Nov 13, 2025

This is achieved by setting a specific DAV attribute. At the moment there is one handler in dav-apps FilesPlugin and it could overwrite the value with "false". We make sure not to downgrade here and prevent downgrade from dav (possible race condition).

Summary

TODO

  • remove code duplication by moving affected code into a SecureView service class.

Checklist

  • Code is properly formatted
  • Sign-off message is added to all commits
  • Documentation (manuals or wiki) has been updated or is not required

@blizzz blizzz added bug Something isn't working 2. developing Work in progress labels Nov 13, 2025
@github-project-automation github-project-automation bot moved this to 🧭 Planning evaluation (don't pick) in 📝 Office team Nov 13, 2025
@blizzz blizzz moved this from 🧭 Planning evaluation (don't pick) to 🏗️ In progress in 📝 Office team Nov 13, 2025
// FIXME: coordinate with Files how a better solution looks like. Maybe by setting it only to 'true' by any provider? To avoid overwriting. Or throwing a dedicated event in just this case?
$propFind->set(FilesPlugin::SHARE_HIDE_DOWNLOAD_PROPERTYNAME, 'true');
// avoid potential race condition with FilesPlugin that may set it to "false"
$propFind->handle(FilesPlugin::SHARE_HIDE_DOWNLOAD_PROPERTYNAME, 'true');
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@susnux this works, but is uncomfortably hacky. Maybe sufficient for 32 and 31, but what do you think of making the dav app emit an event here and stay the whole owner of that attribute? Listeners can then mark a node download-hidden only.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not that sure because for the DAV part probably @salmart-dev or @CarlSchwan would be good to also include in the process.

@blizzz blizzz force-pushed the fix/5170/hide-download-button-on-secure-view branch from 901762a to 2896f1e Compare November 14, 2025 23:35
@blizzz blizzz requested review from elzody and juliusknorr November 14, 2025 23:36
@blizzz blizzz force-pushed the fix/5170/hide-download-button-on-secure-view branch from 2896f1e to 9301da6 Compare November 21, 2025 21:38
This is achieved by setting a specific DAV attribute. At the moment there
is one handler in dav-apps FilesPlugin and it could overwrite the value
with "false". We make sure not to downgrade here and prevent downgrade
from dav (possible race condition).

Signed-off-by: Arthur Schiwon <[email protected]>
@blizzz blizzz force-pushed the fix/5170/hide-download-button-on-secure-view branch from 58974e7 to 3b27369 Compare November 21, 2025 23:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

2. developing Work in progress bug Something isn't working

Projects

Status: 🏗️ In progress

Development

Successfully merging this pull request may close these issues.

better warning when trying to download a file that is restrictied via secure view

3 participants