Delete permission can be added on reshare
该报告还没有中文解读。
原文摘录
摘自原文(1864 字符中的一小部分)
user0 creates folder /test user0 creates file /test/file.txt user0 shares folder /test with user1 with read+share permissions (17) user1 receives the folder /test and can read-download /test/file.txt but not delete - good user1 uses the sharing API to share folder /test with user2, and specifies …
原文中的代码
if ($mount instanceof MoveableMount && $internalPath === '') {
$data['permissions'] |= \OCP\Constants::PERMISSION_DELETE;
}默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @phil-davis · 版权归作者与 Nextcloud 所有