Deport authorization check in the nodeleaf put() method.

pydio · Oct 11, 2013 · 5fb62c2 · 5fb62c2
1 parent 07c9e33
commit 5fb62c2
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/core/src/core/classes/sabredav/ajaxplorer/class.AJXP_Sabre_NodeLeaf.php b/core/src/core/classes/sabredav/ajaxplorer/class.AJXP_Sabre_NodeLeaf.php
@@ -52,6 +52,9 @@ function put($data){
         // Warning, passed by ref
         $p = $this->path;
 
+        if(!AuthService::getLoggedUser()->canRead($this->repository->getId())){
+            throw new \Sabre\DAV\Exception\Forbidden() ;
+        }
         $this->getAccessDriver()->nodeWillChange($p, intval($_SERVER["CONTENT_LENGTH"]));
 
         $stream = fopen($this->getUrl(), "w");