Check node permissions when restoring a version

Signed-off-by: Louis Chemineau <louis@chmn.me>
nextcloud · Feb 21, 2024 · 19fcee2 · 19fcee2
1 parent fa1a08f
commit 19fcee2
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php
@@ -178,6 +178,10 @@ public function createVersion(IUser $user, FileInfo $file) {
 	}
 
 	public function rollback(IVersion $version) {
+		if (!$this->currentUserHasPermissions($version, \OCP\Constants::PERMISSION_UPDATE)) {
+			throw new Forbidden('You cannot restore this version because you do not have update permissions on the source file.');
+		}
+
 		return Storage::rollback($version->getVersionPath(), $version->getRevisionId(), $version->getUser());
 	}