Check node permissions when restoring a version

Signed-off-by: Louis Chemineau <louis@chmn.me> [skip ci]
nextcloud · Feb 27, 2024 · 20cec42 · 20cec42
1 parent 45acb6d
commit 20cec42
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php
@@ -97,6 +97,10 @@ public function createVersion(IUser $user, FileInfo $file) {
 	}
 
 	public function rollback(IVersion $version) {
+		if (!$this->currentUserHasPermissions($version, \OCP\Constants::PERMISSION_UPDATE)) {
+			throw new Forbidden('You cannot restore this version because you do not have update permissions on the source file.');
+		}
+
 		return Storage::rollback($version->getVersionPath(), $version->getRevisionId(), $version->getUser());
 	}