Skip to content

Prevent archieved download on secure view#19349

Merged
rullzer merged 1 commit intomasterfrom
bugfix/noid/prevent-download-on-secure-view
Feb 8, 2020
Merged

Prevent archieved download on secure view#19349
rullzer merged 1 commit intomasterfrom
bugfix/noid/prevent-download-on-secure-view

Conversation

@nickvergessen
Copy link
Member

@nickvergessen nickvergessen commented Feb 7, 2020

No description provided.

@nickvergessen
Prevent archieved download on secure view
35d4ca4 
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen nickvergessen added this to the Nextcloud 19 milestone Feb 7, 2020
@nickvergessen
Copy link
Member Author

nickvergessen commented Feb 7, 2020

/backport to stable18

@nickvergessen
Copy link
Member Author

nickvergessen commented Feb 7, 2020

/backport to stable17

@nickvergessen
Copy link
Member Author

nickvergessen commented Feb 7, 2020

/backport to stable16

@ChristophWurst ChristophWurst added 4. to release Ready to be released and/or waiting for tests to finish and removed 3. to review Waiting for reviews labels Feb 7, 2020
@rullzer rullzer merged commit 302ea06 into master Feb 8, 2020
@rullzer rullzer deleted the bugfix/noid/prevent-download-on-secure-view branch February 8, 2020 09:18
@backportbot-nextcloud backportbot-nextcloud bot mentioned this pull request Feb 8, 2020
Merged
@backportbot-nextcloud
Copy link

backportbot-nextcloud bot commented Feb 8, 2020

backport to stable18 in #19360

@backportbot-nextcloud backportbot-nextcloud bot mentioned this pull request Feb 8, 2020
Merged
@backportbot-nextcloud
Copy link

backportbot-nextcloud bot commented Feb 8, 2020

backport to stable17 in #19361

@backportbot-nextcloud backportbot-nextcloud bot mentioned this pull request Feb 8, 2020
Merged
@backportbot-nextcloud
Copy link

backportbot-nextcloud bot commented Feb 8, 2020

backport to stable16 in #19362

@juliusknorr juliusknorr mentioned this pull request Feb 21, 2020
Closed
@davewkzn
Copy link

davewkzn commented Aug 2, 2023

Hi Nextcloud team.

Thank you for a great product.

Sadly it looks like this bug is back again - simply adding /download in the URL allows a bypass of NextCloud's "Secure view" feature.
Line 402 of ShareController.php in master and our version (27.0.1) seems to have regressed to:
if (!$this->validateShare($share)) {

Manually applying the following patch resolves the problem:
35d4ca4

Please may I ask for this to be investigated?
Many thanks

@nickvergessen
Copy link
Member Author

nickvergessen commented Aug 2, 2023

It should only work for single files since #20032
Can you confirm?

@davewkzn
Copy link

davewkzn commented Aug 2, 2023

Thank you Nick. Correct. I only tested using a single file, and found that adding "/download" then downloads the file.
I should have mentioned that I tested using a PDF file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChristophWurst ChristophWurst ChristophWurst approved these changes

@juliusknorr juliusknorr juliusknorr approved these changes

@rullzer rullzer Awaiting requested review from rullzer

@blizzz blizzz Awaiting requested review from blizzz

Assignees

No one assigned

Labels

4. to release Ready to be released and/or waiting for tests to finish bug feature: sharing regression

Projects

None yet

Milestone

Nextcloud 19

Development

Successfully merging this pull request may close these issues.

5 participants

@nickvergessen @davewkzn @ChristophWurst @juliusknorr @rullzer