From 8f97f88bb95bd69804966bb0466904bf85eceacc Mon Sep 17 00:00:00 2001 From: Max Date: Tue, 14 Jul 2026 09:24:34 +0200 Subject: [PATCH] fix(share): detect if documentId is outside of share early Signed-off-by: Max --- lib/Middleware/SessionMiddleware.php | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/lib/Middleware/SessionMiddleware.php b/lib/Middleware/SessionMiddleware.php index a5d555f4ae4..460a8e0b06f 100644 --- a/lib/Middleware/SessionMiddleware.php +++ b/lib/Middleware/SessionMiddleware.php @@ -22,6 +22,8 @@ use OCP\AppFramework\Http\Response; use OCP\AppFramework\Middleware; use OCP\Constants; +use OCP\Files\File; +use OCP\Files\Folder; use OCP\Files\IRootFolder; use OCP\Files\NotPermittedException; use OCP\IL10N; @@ -136,6 +138,17 @@ private function assertUserOrShareToken(ISessionAwareController $controller): vo throw new InvalidSessionException(); } + if ($share->getNodeType() === 'folder') { + $folder = $share->getNode(); + if (!$folder instanceof Folder) { + throw new InvalidSessionException(); + } + $file = $folder->getFirstNodeById($documentId); + if (!$file instanceof File) { + throw new InvalidSessionException(); + } + } + if ($share->getPassword() !== null) { $shareIds = $this->session->get('public_link_authenticated'); $shareIds = is_array($shareIds) ? $shareIds : [$shareIds];