Prevent creation of empty files/folders for accounts having no available quota#40505
Prevent creation of empty files/folders for accounts having no available quota#40505pako81 wants to merge 1 commit intoowncloud:masterfrom pako81:prevent_empty_folders
Conversation
|
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
pako81
changed the title
pako81
changed the title
pako81
changed the title
|
💥 Acceptance tests pipeline apiFilesExt-mariadb10.2-php7.4 failed. The build has been cancelled. |
|
@jvillafanez do you think the approach here is correct? |
|
The approach could be fine if we want to allow to create folders under special circumstances. I mean, the 0 quota only applies to access through the webdav interface, but there could be other type of accesses that could bypass that check by using the view object directly. There is probably no good use case for this, but it's an option. If we need to ensure that no folder is added under any circumstance (having 0 quota), we'll have to move the check elsewhere. |
| } | ||
|
|
||
| list($used, $free) = $this->getQuotaInfo(); | ||
| if ($free == 0) { |
There was a problem hiding this comment.
Always use ===. If == is used, it needs a comment explaining why it's needed.
|
|
||
| list($used, $free) = $this->getQuotaInfo(); | ||
| if ($free == 0) { | ||
| throw new SabreForbidden(); |
There was a problem hiding this comment.
I'm sure you can include a meaningful message in the exception. It probably doesn't need to be translated, but in any case it will help to know what happened if we ever hit this exception, otherwise we could mistake the actual error for any of the other forbidden exceptions this method throws.
|
Not sure why I left the review as pending... anyway I'm assuming the approach is ok (regarding my previous post) |
|
Re-opened on #40567. |
3 participants
Description
Prevent creation of empty files/folders for accounts having no available quota
Related Issue
Motivation and Context
Until now it was possible for users having 0 quota or who already reached the limit of their assigned quota to still create empty files/folders, which generates confusion. The PR fixes this behaviour.
How Has This Been Tested?
Manually:
Test 1. :
adminassign quota0 Bto useruser1user1over WebUI and try to create empty files or folders: an errorCould not create..is returnedTest 2. :
user1who has a valid quota assigned create a folderfor guestsand share it with full permissions with guest userguest@owncloud.comadminassign now quota0 Bto useruser1guest@owncloud.com, enter the folderfor guestsand try to create empty files or (sub)folders: an errorCould not create..is returnedTest 3. :
user1having i.e. 10MB quota assigned and already using 100% of the available spaceTest 4. :
adminassign quota0 Bto useruser1user1via desktop client to his personal storage: sync client returns a 403 Forbidden toMKCOLandPUToperations when trying to respectively create empty folders and files.Types of changes
Checklist: