nextcloud-server-mirror/apps/files_sharing/lib/ViewOnly.php

<?php

/**
 * SPDX-FileCopyrightText: 2022 Nextcloud GmbH and Nextcloud contributors
 * SPDX-FileCopyrightText: 2019 ownCloud GmbH
 * SPDX-License-Identifier: AGPL-3.0-only
 */

namespace OCA\Files_Sharing;

use OCP\Files\File;
use OCP\Files\Folder;
use OCP\Files\Node;
use OCP\Files\NotFoundException;

/**
 * Handles restricting for download of files
 */
class ViewOnly {

	public function __construct(
		private ?Folder $folder,
	) {
	}

	/**
	 * @param string[] $pathsToCheck paths to check, relative to the given folder
	 * @return bool
	 */
	public function check(array $pathsToCheck): bool {
		if ($this->folder === null) {
			throw new \LogicException('Folder is not set but this check requires it.');
		}

		if (empty($pathsToCheck)) {
			return $this->dirRecursiveCheck($this->folder);
		}

		// If any of elements cannot be downloaded, prevent whole download
		foreach ($pathsToCheck as $file) {
			try {
				$info = $this->folder->get($file);
				if ($info instanceof File) {
					// access to filecache is expensive in the loop
					if (!$this->isDownloadable($info)) {
						return false;
					}
				} elseif ($info instanceof Folder) {
					// get directory content is rather cheap query
					if (!$this->dirRecursiveCheck($info)) {
						return false;
					}
				}
			} catch (NotFoundException) {
				continue;
			}
		}
		return true;
	}

	/**
	 * @param Folder $dirInfo
	 * @return bool
	 * @throws NotFoundException
	 */
	private function dirRecursiveCheck(Folder $dirInfo): bool {
		if (!$this->isDownloadable($dirInfo)) {
			return false;
		}
		// If any of elements cannot be downloaded, prevent whole download
		$files = $dirInfo->getDirectoryListing();
		foreach ($files as $file) {
			if ($file instanceof File) {
				if (!$this->isDownloadable($file)) {
					return false;
				}
			} elseif ($file instanceof Folder) {
				if (!$this->dirRecursiveCheck($file)) {
					return false;
				}
			}
		}

		return true;
	}

	/**
	 * @param Node $fileInfo
	 * @return bool
	 */
	public function isDownloadable(Node $fileInfo): bool {
		// Restrict view-only to nodes which are shared
		try {
			$storage = $fileInfo->getStorage();
		} catch (NotFoundException) {
			return true;
		}

		if (!$storage->instanceOfStorage(SharedStorage::class)) {
			return true;
		}

		// Extract extra permissions
		/** @var SharedStorage $storage */
		$share = $storage->getShare();

		// Check whether download-permission was denied (granted if not set)
		$attributes = $share->getAttributes();
		$canDownload = $attributes?->getAttribute('permissions', 'download');

		return $canDownload !== false;
	}
}