From 0770748c0f5c976bb45c51768813df53b1fa9ad3 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Thu, 5 Dec 2024 05:40:45 +0000 Subject: [PATCH] validate file and bucket permission - validate file update permission when creating file token --- .../Tokens/Buckets/Files/CreateFileToken.php | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/CreateFileToken.php b/src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/CreateFileToken.php index 7f5ac38fea..e422cd1c8a 100644 --- a/src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/CreateFileToken.php +++ b/src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/CreateFileToken.php @@ -9,6 +9,7 @@ use Appwrite\Utopia\Response; use Utopia\Database\Database; use Utopia\Database\Document; use Utopia\Database\Helpers\ID; +use Utopia\Database\Validator\Authorization; use Utopia\Database\Validator\Datetime as DatetimeValidator; use Utopia\Database\Validator\Permissions; use Utopia\Database\Validator\UID; @@ -60,8 +61,24 @@ class CreateFileToken extends Action public function action(string $bucketId, string $fileId, ?string $expire, ?array $permissions, Response $response, Database $dbForProject, Document $user, Event $queueForEvents) { + /** + * @var Document $bucket + * @var Document $file + */ ['bucket' => $bucket, 'file' => $file] = $this->getFileAndBucket($dbForProject, $bucketId, $fileId); + $fileSecurity = $bucket->getAttribute('fileSecurity', false); + $validator = new Authorization(Database::PERMISSION_UPDATE); + $bucketPermission = $validator->isValid($bucket->getUpdate()); + if (!$fileSecurity && !$bucketPermission) { + throw new Exception(Exception::USER_UNAUTHORIZED); + } + + $filePermission = $validator->isValid($file->getUpdate()); + if ($fileSecurity && !$bucketPermission && !$filePermission) { + throw new Exception(Exception::USER_UNAUTHORIZED); + } + $token = $dbForProject->createDocument('resourceTokens', new Document([ '$id' => ID::unique(), 'secret' => Auth::tokenGenerator(128),