Check permissions when labeling a version

Signed-off-by: Louis Chemineau <louis@chmn.me>
nextcloud · Feb 21, 2024 · 3c184c4 · 3c184c4
1 parent 19fcee2
commit 3c184c4
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/apps/files_versions/lib/Versions/LegacyVersionsBackend.php b/apps/files_versions/lib/Versions/LegacyVersionsBackend.php
@@ -228,6 +228,10 @@ public function getVersionFile(IUser $user, FileInfo $sourceFile, $revision): Fi
 	}
 
 	public function setVersionLabel(IVersion $version, string $label): void {
+		if (!$this->currentUserHasPermissions($version, \OCP\Constants::PERMISSION_UPDATE)) {
+			throw new Forbidden('You cannot label this version because you do not have update permissions on the source file.');
+		}
+
 		$versionEntity = $this->versionsMapper->findVersionForFileId(
 			$version->getSourceFile()->getId(),
 			$version->getTimestamp(),