[Pkg-owncloud-commits] [owncloud] 30/258: Added permission check for drag and drop

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to branch master
in repository owncloud.

commit 69cc2044f05ae9606e45e57d973fdb8bc28382f9
Author: Vincent Petry <pvince81 at owncloud.com>
Date:   Thu Sep 4 19:58:49 2014 +0200

    Added permission check for drag and drop
    
    When dropping files onto a read-only folder, a notification
    is now shown instead of attempting to upload.
    
    This for both the drag for upload and drag from inside the file list
    cases.
    
    Backport of f1bfe35cda2f11d1b38726cf2d4f879427b2c8d5 from master
---
 apps/files/js/filelist.js           | 19 +++++++++++++++++++
 apps/files/js/files.js              |  7 ++++++-
 apps/files/tests/js/filelistSpec.js | 11 ++++++++++-
 3 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js
index 165ee90..7d568fd 100644
--- a/apps/files/js/filelist.js
+++ b/apps/files/js/filelist.js
@@ -1616,6 +1616,18 @@
 		},
 
 		/**
+		 * Shows a "permission denied" notification
+		 */
+		_showPermissionDeniedNotification: function() {
+			var message = t('core', 'You don’t have permission to upload or create files here');
+			OC.Notification.show(message);
+			//hide notification after 10 sec
+			setTimeout(function() {
+				OC.Notification.hide();
+			}, 5000);
+		},
+
+		/**
 		 * Setup file upload events related to the file-upload plugin
 		 */
 		setupUploadEvents: function() {
@@ -1646,6 +1658,12 @@
 					// remember as context
 					data.context = dropTarget;
 
+					// if permissions are specified, only allow if create permission is there
+					var permissions = dropTarget.data('permissions');
+					if (!_.isUndefined(permissions) && (permissions & OC.PERMISSION_CREATE) === 0) {
+						self._showPermissionDeniedNotification();
+						return false;
+					}
 					var dir = dropTarget.data('file');
 					// if from file list, need to prepend parent dir
 					if (dir) {
@@ -1670,6 +1688,7 @@
 					// cancel uploads to current dir if no permission
 					var isCreatable = (self.getDirectoryPermissions() & OC.PERMISSION_CREATE) !== 0;
 					if (!isCreatable) {
+						self._showPermissionDeniedNotification();
 						return false;
 					}
 				}
diff --git a/apps/files/js/files.js b/apps/files/js/files.js
index df0c40a..5fcf99d 100644
--- a/apps/files/js/files.js
+++ b/apps/files/js/files.js
@@ -433,7 +433,12 @@ var folderDropOptions = {
 			return false;
 		}
 
-		var targetPath = FileList.getCurrentDirectory() + '/' + $(this).closest('tr').data('file');
+		var $tr = $(this).closest('tr');
+		if (($tr.data('permissions') & OC.PERMISSION_CREATE) === 0) {
+			FileList._showPermissionDeniedNotification();
+			return false;
+		}
+		var targetPath = FileList.getCurrentDirectory() + '/' + $tr.data('file');
 
 		var files = FileList.getSelectedFiles();
 		if (files.length === 0) {
diff --git a/apps/files/tests/js/filelistSpec.js b/apps/files/tests/js/filelistSpec.js
index cad5643..65a89ef 100644
--- a/apps/files/tests/js/filelistSpec.js
+++ b/apps/files/tests/js/filelistSpec.js
@@ -1835,7 +1835,6 @@ describe('OCA.Files.FileList tests', function() {
 			// but it makes it possible to simulate the event triggering to
 			// test the response of the handlers
 			$uploader = $('#file_upload_start');
-			fileList.setupUploadEvents();
 			fileList.setFiles(testFiles);
 		});
 
@@ -1912,6 +1911,16 @@ describe('OCA.Files.FileList tests', function() {
 				ev = dropOn(fileList.$fileList.find('th:first'));
 
 				expect(ev.result).toEqual(false);
+				expect(notificationStub.calledOnce).toEqual(true);
+			});
+			it('drop on an folder does not trigger upload if no upload permission on that folder', function() {
+				var $tr = fileList.findFileEl('somedir');
+				var ev;
+				$tr.data('permissions', OC.PERMISSION_READ);
+				ev = dropOn($tr);
+
+				expect(ev.result).toEqual(false);
+				expect(notificationStub.calledOnce).toEqual(true);
 			});
 			it('drop on a file row inside the table triggers upload to current folder', function() {
 				var ev;

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git