From 71948d670ea32a2f43e85d4a99fd6f685fd31907 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julius=20H=C3=A4rtl?= Date: Wed, 3 Jan 2024 15:32:40 +0100 Subject: [PATCH] fix: Consider a deleted board inaccessible to share recipients MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only the owner can delete/undo a board deletion so there is no reason other users should have any permission on a board marked as deleted Signed-off-by: Julius Härtl --- lib/Service/PermissionService.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/Service/PermissionService.php b/lib/Service/PermissionService.php index c42ca8045..62a61dc6a 100644 --- a/lib/Service/PermissionService.php +++ b/lib/Service/PermissionService.php @@ -102,8 +102,9 @@ class PermissionService { return $cached; } - $owner = $this->userIsBoardOwner($boardId); - $acls = $this->aclMapper->findAll($boardId); + $board = $this->getBoard($boardId); + $owner = $this->userIsBoardOwner($boardId, $userId); + $acls = $board->getDeletedAt() === 0 ? $this->aclMapper->findAll($boardId) : []; $permissions = [ Acl::PERMISSION_READ => $owner || $this->userCan($acls, Acl::PERMISSION_READ), Acl::PERMISSION_EDIT => $owner || $this->userCan($acls, Acl::PERMISSION_EDIT),