nextcloud-server-mirror

0 Fork 0

mirror of https://github.com/nextcloud/server.git synced 2026-11-09 02:14:48 +01:00

Files

T

History

Ferdinand Thiessen c60fa8659c fix(files): check that the source is deletable before moving between storages

`Local::moveFromStorage()`, the same-storage branch of
`Common::moveFromStorage()` and the same-bucket branch of
`ObjectStoreStorage::moveFromStorage()` resolve the jail of the source
storage and move the file on the underlying storage. This also skips any
`PermissionsMask` of the source, so a file could be moved out of a share
or mount without delete permissions.

Check `isDeletable()` on the source before taking any of these shortcuts,
like the generic copy-and-delete fallback already does.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-4RX49FAX.

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

2026-11-04 16:32:26 +00:00

AzureTest.php

chore: add missing Override attribute to test files

2026-04-28 21:29:28 +02:00

FailDeleteObjectStore.php

chore: add missing Override attribute to test files

2026-04-28 21:29:28 +02:00

FailWriteObjectStore.php

chore: add missing Override attribute to test files

2026-04-28 21:29:28 +02:00

LocalTest.php

chore: Apply new coding standard to all files