Ferdinand Thiessen b5e7afd35f fix(files): check source permissions in Node::move() ...

`Node::move()` only checked that the target folder accepts new files, but
never that the source may be moved away. Any caller passing it a node from
a share or mount without delete permissions could therefore move that
file out.

Apply the same checks as WebDAV (`FilesPlugin::checkMove()`): a rename
within the same folder follows `DavUtil::canRename()`, a move into another
folder requires the source to be deletable unless it is the root of a
movable mount.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-4RX49FAX.

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

2026-11-04 16:32:26 +00:00

..

FileTest.php

chore: Apply new coding standard to all files

2026-06-01 13:46:39 +02:00

FolderTest.php

test: add test for searching for mount name

2026-09-22 18:36:05 +02:00

HookConnectorTest.php

chore: add missing Override attribute to test files

2026-04-28 21:29:28 +02:00

IntegrationTest.php

chore: Apply new coding standard to all files

2026-06-01 13:46:39 +02:00

NodeTestCase.php

fix(files): check source permissions in Node::move()

2026-11-04 16:32:26 +00:00

RootTest.php

refactor: Expose a public exception when no user is found

2026-06-30 21:56:10 +02:00