harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

only let visitors remove their own files.

Browse Source
This commit is contained in:
friendica
2014-01-09 19:20:10 -08:00
parent 49882f2be4
commit a309bc0d47
5 changed files with 35 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
include/reddav.php
View File

@@ -115,11 +115,12 @@ class RedDirectory extends DAV\Node implements DAV\ICollection {
$filesize = 0;
$hash = random_string();
$r = q("INSERT INTO attach ( aid, uid, hash, filename, folder, flags, filetype, filesize, revision, data, created, edited, allow_cid, allow_gid, deny_cid, deny_gid )
VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s' ) ",
$r = q("INSERT INTO attach ( aid, uid, hash, creator, filename, folder, flags, filetype, filesize, revision, data, created, edited, allow_cid, allow_gid, deny_cid, deny_gid )
VALUES ( %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s' ) ",
intval($c[0]['channel_account_id']),
intval($c[0]['channel_id']),
dbesc($hash),
dbesc($this->auth->observer),
dbesc($name),
dbesc($this->folder_hash),
dbesc(ATTACH_FLAG_OS),
@@ -415,6 +416,13 @@ class RedFile extends DAV\Node implements DAV\IFile {
return;
}
if($this->auth->owner_id !== $this->auth->channel_id) {
if(($this->auth->observer !== $this->data['creator']) || ($this->data['flags'] & ATTACH_FLAG_DIR)) {
throw new DAV\Exception\Forbidden('Permission denied.');
return;
}
}
attach_delete($this->auth->owner_id,$this->data['hash']);
}