fix(ApiService): Catch NotPermittedException and return 404

Also adjust 404 error message in create api function in case of
NotPermittedException. We don't want to distinguish between missing
permissions and nonexisting files to not reveal that the file exists.

Signed-off-by: Jonas <jonas@freesources.org>

lib/Service/ApiService.php

@@ -65,7 +65,9 @@ public function create(?int $fileId = null, ?string $filePath = null, ?string $b
 					$file = $this->documentService->getFileById($fileId, $this->userId);
 				} catch (NotFoundException|NotPermittedException $e) {
 					$this->logger->error('No permission to access this file', [ 'exception' => $e ]);
-					return new DataResponse(['error' => $this->l10n->t('No permission to access this file.')], Http::STATUS_NOT_FOUND);
+					return new DataResponse([
+						'error' => $this->l10n->t('File not found')
+					], Http::STATUS_NOT_FOUND);
 				}
 			} else {
 				return new DataResponse(['error' => 'No valid file argument provided'], Http::STATUS_PRECONDITION_FAILED);
@@ -201,7 +203,7 @@ public function sync(Session $session, Document $document, int $version = 0, ?st
 			// ensure file is still present and accessible
 			$file = $this->documentService->getFileForSession($session, $shareToken);
 			$this->documentService->assertNoOutsideConflict($document, $file);
-		} catch (NotFoundException|InvalidPathException $e) {
+		} catch (NotPermittedException|NotFoundException|InvalidPathException $e) {
 			$this->logger->info($e->getMessage(), ['exception' => $e]);
 			return new DataResponse([
 				'message' => 'File not found'
@@ -226,7 +228,7 @@ public function sync(Session $session, Document $document, int $version = 0, ?st
 	public function save(Session $session, Document $document, int $version = 0, ?string $autosaveContent = null, ?string $documentState = null, bool $force = false, bool $manualSave = false, ?string $shareToken = null): DataResponse {
 		try {
 			$file = $this->documentService->getFileForSession($session, $shareToken);
-		} catch (NotFoundException $e) {
+		} catch (NotPermittedException|NotFoundException $e) {
 			$this->logger->info($e->getMessage(), ['exception' => $e]);
 			return new DataResponse([
 				'message' => 'File not found'