fix: allow users to only update own external storage configurations

owncloud · Mar 25, 2024 · ff679a6 · ff679a6
1 parent b77fe84
commit ff679a6
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/lib/private/Files/External/Service/UserStoragesService.php b/lib/private/Files/External/Service/UserStoragesService.php
@@ -128,6 +128,12 @@ public function addStorage(IStorageConfig $newStorage) {
 	 * @throws NotFoundException if the given storage does not exist in the config
 	 */
 	public function updateStorage(IStorageConfig $updatedStorage) {
+		$id = $updatedStorage->getId();
+		$mount = $this->dbConfig->getPersonalMountById($id, $this->getUser()->getUID());
+		if (!\is_array($mount)) {
+			throw new NotFoundException('Storage with id "' . $id . '" not found');
+		}
+
 		$updatedStorage->setApplicableUsers([$this->getUser()->getUID()]);
 		return parent::updateStorage($updatedStorage);
 	}