Merge pull request #3879 from nextcloud/backport/3635/stable28

[stable28] fix: Block incompatible operations with remote tokens
nextcloud · Aug 6, 2024 · 1a0f7db · 1a0f7db
2 parents ca101be + 8b4676e
commit 1a0f7db
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/lib/Controller/WopiController.php b/lib/Controller/WopiController.php
@@ -218,11 +218,11 @@ public function checkFileInfo($fileId, $access_token) {
 			'UserExtraInfo' => [],
 			'UserPrivateInfo' => [],
 			'UserCanWrite' => $canWriteThroughLock && (bool)$wopi->getCanwrite(),
-			'UserCanNotWriteRelative' => $isPublic || $this->encryptionManager->isEnabled() || $wopi->getHideDownload(),
+			'UserCanNotWriteRelative' => $isPublic || $this->encryptionManager->isEnabled() || $wopi->getHideDownload() || $wopi->isRemoteToken(),
 			'PostMessageOrigin' => $wopi->getServerHost(),
 			'LastModifiedTime' => Helper::toISO8601($file->getMTime()),
-			'SupportsRename' => !$isVersion,
-			'UserCanRename' => !$isPublic && !$isVersion,
+			'SupportsRename' => !$isVersion && !$wopi->isRemoteToken(),
+			'UserCanRename' => !$isPublic && !$isVersion && !$wopi->isRemoteToken(),
 			'EnableInsertRemoteImage' => !$isPublic,
 			'EnableShare' => $file->isShareable() && !$isVersion && !$isPublic,
 			'HideUserList' => '',