[Pkg-owncloud-commits] [owncloud] 12/32: Check whether the user has permissions to add personal storage backends

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch master
in repository owncloud.

commit d3a15b6b0765661ce865a71c37e45b2340bf0a95
Author: Lukas Reschke <lukas at statuscode.ch>
Date:   Fri Apr 18 11:46:48 2014 +0200

    Check whether the user has permissions to add personal storage backends
    
    Quick’n dirty back port of #8182 - master has a better fix but that
    should be good enough…
    
    missing return - OCP\JSON::success does not terminate the PHP process - which is good ;-)
    
    Use error instead of success
    
    Revert "Use error instead of success"
    
    This reverts commit e2d5535a5aa436c3896e46f0b9e8ff1bd5640d4d.
    
    Use error instead of success
---
 apps/files_external/ajax/addMountPoint.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/apps/files_external/ajax/addMountPoint.php b/apps/files_external/ajax/addMountPoint.php
index 9100d47..2423692 100644
--- a/apps/files_external/ajax/addMountPoint.php
+++ b/apps/files_external/ajax/addMountPoint.php
@@ -1,10 +1,15 @@
 <?php
 
 OCP\JSON::checkAppEnabled('files_external');
+OCP\JSON::checkLoggedIn();
 OCP\JSON::callCheck();
 
 if ($_POST['isPersonal'] == 'true') {
-	OCP\JSON::checkLoggedIn();
+	// Check whether the user has permissions to add personal storage backends
+	if(OCP\Config::getAppValue('files_external', 'allow_user_mounting', 'yes') !== 'yes') {
+		OCP\JSON::error(array('data' => array('message' => 'no permission')));
+		return;
+	}
 	$isPersonal = true;
 } else {
 	OCP\JSON::checkAdminUser();

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git