From 6e6ae80fda1ceb955fc448a8b4f8ea2470e123c8 Mon Sep 17 00:00:00 2001 From: MaksimChegulov Date: Thu, 19 Jan 2023 14:58:14 +0300 Subject: [PATCH] Files: fixed security check --- products/ASC.Files/Core/Core/FileStorageService.cs | 2 +- products/ASC.Files/Core/Utils/EntryManager.cs | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/products/ASC.Files/Core/Core/FileStorageService.cs b/products/ASC.Files/Core/Core/FileStorageService.cs index bdfd9cea8b..689492ba55 100644 --- a/products/ASC.Files/Core/Core/FileStorageService.cs +++ b/products/ASC.Files/Core/Core/FileStorageService.cs @@ -1207,7 +1207,7 @@ public class FileStorageService //: IFileStorageService var fileDao = GetFileDao(); var file = await fileDao.GetFileAsync(fileId, version); ErrorIf(file == null, FilesCommonResource.ErrorMassage_FileNotFound); - ErrorIf(!await _fileSecurity.CanEditAsync(file) || _userManager.IsUser(_authContext.CurrentAccount.ID), FilesCommonResource.ErrorMassage_SecurityException_EditFile); + ErrorIf(!await _fileSecurity.CanEditHistoryAsync(file) || _userManager.IsUser(_authContext.CurrentAccount.ID), FilesCommonResource.ErrorMassage_SecurityException_EditFile); ErrorIf(await _entryManager.FileLockedForMeAsync(file.Id), FilesCommonResource.ErrorMassage_LockedFile); ErrorIf(file.RootFolderType == FolderType.TRASH, FilesCommonResource.ErrorMassage_ViewTrashItem); diff --git a/products/ASC.Files/Core/Utils/EntryManager.cs b/products/ASC.Files/Core/Utils/EntryManager.cs index ce42be464c..cfb22c1adc 100644 --- a/products/ASC.Files/Core/Utils/EntryManager.cs +++ b/products/ASC.Files/Core/Utils/EntryManager.cs @@ -1568,7 +1568,7 @@ public class EntryManager throw new FileNotFoundException(FilesCommonResource.ErrorMassage_FileNotFound); } - if (checkRight && !editLink && (!await _fileSecurity.CanEditAsync(fromFile) || _userManager.IsUser(_authContext.CurrentAccount.ID))) + if (checkRight && !editLink && (!await _fileSecurity.CanEditHistoryAsync(fromFile) || _userManager.IsUser(_authContext.CurrentAccount.ID))) { throw new SecurityException(FilesCommonResource.ErrorMassage_SecurityException_EditFile); } @@ -1691,7 +1691,7 @@ public class EntryManager throw new FileNotFoundException(FilesCommonResource.ErrorMassage_FileNotFound); } - if (checkRight && (!await _fileSecurity.CanEditAsync(fileVersion) || _userManager.IsUser(_authContext.CurrentAccount.ID))) + if (checkRight && (!await _fileSecurity.CanEditHistoryAsync(fileVersion) || _userManager.IsUser(_authContext.CurrentAccount.ID))) { throw new SecurityException(FilesCommonResource.ErrorMassage_SecurityException_EditFile); }