Add more permissions checks

lib/Controller/ApiBase.php

@@ -131,6 +131,10 @@ class ApiBase extends Controller
             throw new \Exception('Folder not found');
         }
 
+        if (!($folder->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
+            throw new \Exception('Folder not readable');
+        }
+
         return $folder;
     }
 
@@ -160,6 +164,11 @@ class ApiBase extends Controller
             return null;
         }
 
+        // Check read permission
+        if (!($file[0]->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
+            return null;
+        }
+
         return $file[0];
     }
 

lib/Controller/ArchiveController.php

@@ -54,7 +54,7 @@ class ArchiveController extends ApiBase
         $file = $file[0];
 
         // Check if user has permissions
-        if (!$file->isUpdateable()) {
+        if (!$file->isUpdateable() || !($file->getPermissions() & \OCP\Constants::PERMISSION_UPDATE)) {
             return new JSONResponse(['message' => 'Cannot update this file'], Http::STATUS_FORBIDDEN);
         }
 

lib/Controller/FacesController.php

@@ -104,6 +104,11 @@ class FacesController extends ApiBase
                 continue;
             }
 
+            // Check read permission
+            if (!($files[0]->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
+                continue;
+            }
+
             // Get (hopefully cached) preview image
             try {
                 $preview = $this->previewManager->getPreview($files[0], 2048, 2048, false);

lib/Controller/ImageController.php

@@ -71,7 +71,7 @@ class ImageController extends ApiBase
         }
 
         // Check if user has permissions
-        if (!$file->isUpdateable()) {
+        if (!$file->isUpdateable() || !($file->getPermissions() & \OCP\Constants::PERMISSION_UPDATE)) {
             return new JSONResponse([], Http::STATUS_FORBIDDEN);
         }
 

lib/Controller/VideoController.php

@@ -62,6 +62,10 @@ class VideoController extends ApiBase
         }
         $file = $files[0];
 
+        if (!($file->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
+            return new JSONResponse(['message' => 'File not readable'], Http::STATUS_FORBIDDEN);
+        }
+
         // Local files only for now
         if (!$file->getStorage()->isLocal()) {
             return new JSONResponse(['message' => 'External storage not supported'], Http::STATUS_FORBIDDEN);