From 8241819f0a688c36d548cf10f7d000700708de48 Mon Sep 17 00:00:00 2001
From: Robin Appelman <robin@icewind.nl>
Date: Mon, 26 Feb 2024 14:48:29 +0100
Subject: [PATCH] fix: mask out rule permissions before merging permissions

Signed-off-by: Robin Appelman <robin@icewind.nl>
---
 lib/ACL/Rule.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ACL/Rule.php b/lib/ACL/Rule.php
index a538f838b..0f9357586 100644
--- a/lib/ACL/Rule.php
+++ b/lib/ACL/Rule.php
@@ -145,7 +145,7 @@ public static function mergeRules(array $rules): Rule {
 		}, 0);
 		// or'ing the permissions combines them with allow overwriting deny
 		$permissions = array_reduce($rules, function (int $permissions, Rule $rule) {
-			return $permissions | $rule->getPermissions();
+			return $permissions | ($rule->getPermissions() & $rule->getMask());
 		}, 0);
 
 		return new Rule(