Merge pull request #3281 from nextcloud/fix/trashbackend/delete-checks

nextcloud · Sep 30, 2024 · 88ecbe1 · 88ecbe1
2 parents f5ee36e + 568a376
commit 88ecbe1
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/lib/Trash/TrashBackend.php b/lib/Trash/TrashBackend.php
@@ -184,14 +184,19 @@ public function removeItem(ITrashItem $item): void {
 			throw new NotFoundException();
 		}
 
-		if ($node->getStorage()->unlink($node->getInternalPath()) === false) {
-			throw new \Exception('Failed to remove item from trashbin');
+		if (!$this->userHasAccessToPath($item->getUser(), $item->getPath(), Constants::PERMISSION_DELETE)) {
+			throw new NotPermittedException();
 		}
 
-		if (!$this->userHasAccessToPath($item->getUser(), $item->getPath(), Constants::PERMISSION_DELETE)) {
+		$folderPermissions = $this->folderManager->getFolderPermissionsForUser($item->getUser(), (int)$folderId);
+		if (($folderPermissions & Constants::PERMISSION_DELETE) !== Constants::PERMISSION_DELETE) {
 			throw new NotPermittedException();
 		}
 
+		if ($node->getStorage()->unlink($node->getInternalPath()) === false) {
+			throw new \Exception('Failed to remove item from trashbin');
+		}
+
 		$node->getStorage()->getCache()->remove($node->getInternalPath());
 		if ($item->isRootItem()) {
 			$this->trashManager->removeItem((int)$folderId, $item->getName(), $item->getDeletedTime());