Skip to content

Prevent archieved download on secure view - #19349

Merged
rullzer merged 1 commit into
masterfrom
bugfix/noid/prevent-download-on-secure-view
Feb 8, 2020
Merged

Prevent archieved download on secure view#19349
rullzer merged 1 commit into
masterfrom
bugfix/noid/prevent-download-on-secure-view

Conversation

@nickvergessen

@nickvergessennickvergessen commented Feb 7, 2020

Copy link
Copy Markdown
Member

No description provided.

@nickvergessen
Prevent archieved download on secure view
35d4ca4
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessennickvergessen added this to the Nextcloud 19 milestone Feb 7, 2020
@nickvergessen

nickvergessen commented Feb 7, 2020

Copy link
Copy Markdown
MemberAuthor

/backport to stable18

@nickvergessen

nickvergessen commented Feb 7, 2020

Copy link
Copy Markdown
MemberAuthor

/backport to stable17

@nickvergessen

nickvergessen commented Feb 7, 2020

Copy link
Copy Markdown
MemberAuthor

/backport to stable16

@ChristophWurstChristophWurst added 4. to release Ready to be released and/or waiting for tests to finish and removed 3. to review Waiting for reviews labels Feb 7, 2020
@rullzer
rullzer merged commit 302ea06 into masterFeb 8, 2020
@rullzer
rullzer deleted the bugfix/noid/prevent-download-on-secure-view branch February 8, 2020 09:18
@backportbot-nextcloudbackportbot-nextcloudBot mentioned this pull request Feb 8, 2020
Merged
@backportbot-nextcloud

backportbot-nextcloudBot commented Feb 8, 2020

Copy link
Copy Markdown

backport to stable18 in #19360

@backportbot-nextcloudbackportbot-nextcloudBot mentioned this pull request Feb 8, 2020
Merged
@backportbot-nextcloud

backportbot-nextcloudBot commented Feb 8, 2020

Copy link
Copy Markdown

backport to stable17 in #19361

@backportbot-nextcloudbackportbot-nextcloudBot mentioned this pull request Feb 8, 2020
Merged
@backportbot-nextcloud

backportbot-nextcloudBot commented Feb 8, 2020

Copy link
Copy Markdown

backport to stable16 in #19362

@juliusknorrjuliusknorr mentioned this pull request Feb 21, 2020
Closed
@davewkzn

davewkzn commented Aug 2, 2023

Copy link
Copy Markdown

Hi Nextcloud team.

Thank you for a great product.

Sadly it looks like this bug is back again - simply adding /download in the URL allows a bypass of NextCloud's "Secure view" feature.
Line 402 of ShareController.php in master and our version (27.0.1) seems to have regressed to:
if (!$this->validateShare($share)) {

Manually applying the following patch resolves the problem:
35d4ca4

Please may I ask for this to be investigated?
Many thanks

@nickvergessen

nickvergessen commented Aug 2, 2023

Copy link
Copy Markdown
MemberAuthor

It should only work for single files since #20032
Can you confirm?

@davewkzn

davewkzn commented Aug 2, 2023

Copy link
Copy Markdown

Thank you Nick. Correct. I only tested using a single file, and found that adding "/download" then downloads the file.
I should have mentioned that I tested using a PDF file.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChristophWurstChristophWurstChristophWurst approved these changes
@juliusknorrjuliusknorrjuliusknorr approved these changes
@rullzerrullzerAwaiting requested review from rullzer
@blizzzblizzzAwaiting requested review from blizzz

Assignees

No one assigned

Labels

4. to releaseReady to be released and/or waiting for tests to finishbugfeature: sharingregression

Projects

None yet

Milestone

Nextcloud 19

Development

Successfully merging this pull request may close these issues.

5 participants

@nickvergessen@davewkzn@ChristophWurst@juliusknorr@rullzer