[stable35] fix(files_sharing): cap share presets to the permissions the resharer

apps/files_sharing/src/views/SharingDetailsTab.spec.ts

@@ -165,3 +165,39 @@ describe('SharingDetailsTab.saveShare — password guard', () => {
 		})
 	})
 })
+
+describe('SharingDetailsTab.allPermissions — capped by what the resharer holds', () => {
+	/**
+	 * @param sharePermissions what the current user received on the node
+	 * @param isFolder whether the shared node is a folder
+	 */
+	function permissionsFor(sharePermissions: string | undefined, isFolder = true) {
+		const ctx = {
+			isFolder,
+			fileInfo: { sharePermissions },
+			bundledPermissions: { ALL: 31, ALL_FILE: 15 },
+		} as never
+		const grantable = SharingDetailsTab.computed.grantablePermissions.call(ctx)
+		return SharingDetailsTab.computed.allPermissions.call({ ...(ctx as object), grantablePermissions: grantable })
+	}
+
+	it('keeps every bit when the user owns the node', () => {
+		expect(permissionsFor('31')).toBe('31')
+	})
+
+	it('drops delete when the incoming share has no delete permission', () => {
+		expect(permissionsFor('23')).toBe('23')
+	})
+
+	it('drops create and delete on a read-only reshare', () => {
+		expect(permissionsFor('17')).toBe('17')
+	})
+
+	it('caps file shares against ALL_FILE', () => {
+		expect(permissionsFor('31', false)).toBe('15')
+	})
+
+	it('falls back to full permissions when the DAV property is missing', () => {
+		expect(permissionsFor(undefined)).toBe('31')
+	})
+})

apps/files_sharing/src/views/SharingDetailsTab.vue

@@ -453,8 +453,21 @@ export default {
 			return getBundledPermissions(this.config.excludeReshareFromEdit)
 		},
 
+		/**
+		 * Permissions the current user is allowed to hand out.
+		 * On a reshare this is capped by what they received themselves.
+		 *
+		 * @return {number}
+		 */
+		grantablePermissions() {
+			const received = Number(this.fileInfo.sharePermissions)
+			// A missing prop means we don't know, not that they hold nothing
+			return Number.isNaN(received) ? getBundledPermissions().ALL : received
+		},
+
 		allPermissions() {
-			return this.isFolder ? this.bundledPermissions.ALL.toString() : this.bundledPermissions.ALL_FILE.toString()
+			const bundle = this.isFolder ? this.bundledPermissions.ALL : this.bundledPermissions.ALL_FILE
+			return (bundle & this.grantablePermissions).toString()
 		},
 
 		/**
@@ -1093,7 +1106,10 @@ export default {
 					this.sharingPermission = basePermissions.FILE_DROP.toString()
 				} else {
 					this.sharingPermission = 'custom'
-					this.share.permissions = defaultPermissions
+					// The admin default can ask for more than a resharer may pass on.
+					// Only the value is capped: deciding the branch on the capped value
+					// would push every reshare into this one and expand the accordion.
+					this.share.permissions = defaultPermissions & this.grantablePermissions
 					this.advancedSectionAccordionExpanded = true
 					this.setCustomPermissions = true
 				}
@@ -1117,6 +1133,15 @@ export default {
 		initializePermissions() {
 			this.handleShareType()
 			this.handleDefaultPermissions()
+			// A new share starts from the full permission set, so the atomic
+			// checkboxes would pre-check rights a resharer cannot pass on and the
+			// share would be rejected on save. An existing share keeps what is
+			// stored, so a permission the owner revoked afterwards stays revocable.
+			if (this.isNewShare) {
+				// The editor owns the share it is building, like the rest of this file.
+				// eslint-disable-next-line vue/no-mutating-props
+				this.share.permissions &= this.grantablePermissions
+			}
 			this.handleCustomPermissions()
 		},
 

dist/926-926.js.map.license

@@ -0,0 +1 @@
+926-926.js.license