Adjust permissions for deleting spaces (#2828)

* adjust permissions for deleting spaces Signed-off-by: jkoberg <[email protected]> * changelog Signed-off-by: jkoberg <[email protected]> * block space delete not general delete Signed-off-by: jkoberg <[email protected]>
cs3org · May 6, 2022 · 62b6715 · 62b6715
1 parent bdbc57f
commit 62b6715
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 0 deletions.
diff --git a/changelog/unreleased/deleteSpacePermissions.md b/changelog/unreleased/deleteSpacePermissions.md
@@ -0,0 +1,6 @@
+Bugfix: Check permissions when deleting spaces
+
+Do not allow viewers and editors to delete a space (you need to be manager)
+Block deleting a space via dav service (should use graph to avoid accidental deletes)
+
+https://github.com/cs3org/reva/pull/2827
diff --git a/internal/http/services/owncloud/ocdav/delete.go b/internal/http/services/owncloud/ocdav/delete.go
@@ -154,5 +154,14 @@ func (s *svc) handleSpacesDelete(w http.ResponseWriter, r *http.Request, spaceID
 		return
 	}
 
+	// do not allow deleting spaces via dav endpoint - use graph endpoint instead
+	// we get a relative reference coming from the space root
+	// so if the path is "empty" we a referencing the space
+	if ref.GetPath() == "." {
+		sublog.Info().Msg("deleting spaces via dav is not allowed")
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
 	s.handleDelete(ctx, w, r, ref, sublog)
 }
diff --git a/pkg/storage/utils/decomposedfs/spaces.go b/pkg/storage/utils/decomposedfs/spaces.go
@@ -510,6 +510,11 @@ func (fs *Decomposedfs) DeleteStorageSpace(ctx context.Context, req *provider.De
 		return err
 	}
 
+	// only managers are allowed to disable or purge a drive
+	if err := fs.checkManagerPermission(ctx, n); err != nil {
+		return errtypes.PermissionDenied(fmt.Sprintf("user is not allowed to delete spaces %s", n.ID))
+	}
+
 	if purge {
 		if !n.IsDisabled() {
 			return errtypes.NewErrtypeFromStatus(status.NewInvalidArg(ctx, "can't purge enabled space"))