Merge pull request #5194 from owncloud/fixing-5172-master

adding check isDeletable() on $sourcePath

lib/private/connector/sabre/objecttree.php

@@ -87,6 +87,9 @@ class ObjectTree extends \Sabre_DAV_ObjectTree {
 			if (!$fs->isUpdatable($destinationDir)) {
 				throw new \Sabre_DAV_Exception_Forbidden();
 			}
+			if (!$fs->isDeletable($sourcePath)) {
+				throw new \Sabre_DAV_Exception_Forbidden();
+			}
 		}
 
 		$renameOkay = $fs->rename($sourcePath, $destinationPath);

tests/lib/connector/sabre/objecttree.php

@@ -15,8 +15,9 @@ use Sabre_DAV_Exception_Forbidden;
 
 class TestDoubleFileView extends \OC\Files\View{
 
-	public function __construct($updatables, $canRename = true) {
+	public function __construct($updatables, $deletables, $canRename = true) {
 		$this->updatables = $updatables;
+		$this->deletables = $deletables;
 		$this->canRename = $canRename;
 	}
 
@@ -24,6 +25,10 @@ class TestDoubleFileView extends \OC\Files\View{
 		return $this->updatables[$path];
 	}
 
+	public function isDeletable($path) {
+		return $this->deletables[$path];
+	}
+
 	public function rename($path1, $path2) {
 		return $this->canRename;
 	}
@@ -35,31 +40,32 @@ class ObjectTree extends PHPUnit_Framework_TestCase {
 	 * @dataProvider moveFailedProvider
 	 * @expectedException Sabre_DAV_Exception_Forbidden
 	 */
-	public function testMoveFailed($source, $dest, $updatables) {
-		$this->moveTest($source, $dest, $updatables);
+	public function testMoveFailed($source, $dest, $updatables, $deletables) {
+		$this->moveTest($source, $dest, $updatables, $deletables);
 	}
 
 	/**
 	 * @dataProvider moveSuccessProvider
 	 */
-	public function testMoveSuccess($source, $dest, $updatables) {
-		$this->moveTest($source, $dest, $updatables);
+	public function testMoveSuccess($source, $dest, $updatables, $deletables) {
+		$this->moveTest($source, $dest, $updatables, $deletables);
 		$this->assertTrue(true);
 	}
 
 	function moveFailedProvider() {
 		return array(
-			array('a/b', 'a/c', array('a' => false, 'a/b' => false, 'a/c' => false)),
-			array('a/b', 'b/b', array('a' => false, 'a/b' => false, 'b' => false, 'b/b' => false)),
-			array('a/b', 'b/b', array('a' => false, 'a/b' => true, 'b' => false, 'b/b' => false)),
-			array('a/b', 'b/b', array('a' => true, 'a/b' => true, 'b' => false, 'b/b' => false)),
+			array('a/b', 'a/c', array('a' => false, 'a/b' => false, 'a/c' => false), array()),
+			array('a/b', 'b/b', array('a' => false, 'a/b' => false, 'b' => false, 'b/b' => false), array()),
+			array('a/b', 'b/b', array('a' => false, 'a/b' => true, 'b' => false, 'b/b' => false), array()),
+			array('a/b', 'b/b', array('a' => true, 'a/b' => true, 'b' => false, 'b/b' => false), array()),
+			array('a/b', 'b/b', array('a' => true, 'a/b' => true, 'b' => true, 'b/b' => false), array('a/b' => false)),
 		);
 	}
 
 	function moveSuccessProvider() {
 		return array(
-			array('a/b', 'a/c', array('a' => false, 'a/b' => true, 'a/c' => false)),
-			array('a/b', 'b/b', array('a' => true, 'a/b' => true, 'b' => true, 'b/b' => false)),
+			array('a/b', 'a/c', array('a' => false, 'a/b' => true, 'a/c' => false), array()),
+			array('a/b', 'b/b', array('a' => true, 'a/b' => true, 'b' => true, 'b/b' => false), array('a/b' => true)),
 		);
 	}
 
@@ -68,7 +74,7 @@ class ObjectTree extends PHPUnit_Framework_TestCase {
 	 * @param $dest
 	 * @param $updatables
 	 */
-	private function moveTest($source, $dest, $updatables) {
+	private function moveTest($source, $dest, $updatables, $deletables) {
 		$rootDir = new OC_Connector_Sabre_Directory('');
 		$objectTree = $this->getMock('\OC\Connector\Sabre\ObjectTree',
 			array('nodeExists', 'getNodeForPath'),
@@ -80,7 +86,7 @@ class ObjectTree extends PHPUnit_Framework_TestCase {
 			->will($this->returnValue(false));
 
 		/** @var $objectTree \OC\Connector\Sabre\ObjectTree */
-		$objectTree->fileView = new TestDoubleFileView($updatables);
+		$objectTree->fileView = new TestDoubleFileView($updatables, $deletables);
 		$objectTree->move($source, $dest);
 	}