github
/
filebrowser
mirror of https://github.com/filebrowser/filebrowser
1
0
Fork 0
Code Issues Releases Wiki Activity

fix: check modify permission on file overwrite

pull/1353/head
Ramires Viana 2021-03-26 13:30:14 +00:00
parent 1516d9932b
commit 59f9964e80
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
http/resource.go
View File

@ -118,6 +118,11 @@ func resourcePostHandler(fileCache FileCache) handleFunc {
return http.StatusConflict, nil return http.StatusConflict, nil
} }
// Permission for overwriting the file
if !d.user.Perm.Modify {
return http.StatusForbidden, nil
}
err = delThumbs(r.Context(), fileCache, file) err = delThumbs(r.Context(), fileCache, file)
if err != nil { if err != nil {
return errToStatus(err), err return errToStatus(err), err
@ -204,6 +209,11 @@ var resourcePatchHandler = withUser(func(w http.ResponseWriter, r *http.Request,
dst = addVersionSuffix(dst, d.user.Fs) dst = addVersionSuffix(dst, d.user.Fs)
} }
// Permission for overwriting the file
if override && !d.user.Perm.Modify {
return http.StatusForbidden, nil
}
err = d.RunHook(func() error { err = d.RunHook(func() error {
switch action { switch action {
// TODO: use enum // TODO: use enum