[TikiWiki-commits] [Git][tikiwiki/tiki][29.x] [FIX] download and preview file unified permission checks

Victor Emanouilov pushed to branch 29.x at Tiki Wiki CMS Groupware / Tiki


Commits:
449346d1 by Victor Emanouilov at 2026-04-21T13:59:28+03:00
[FIX] download and preview file unified permission checks

- - - - -


3 changed files:

- lib/core/Services/File/Utilities.php
- tiki-display.php
- tiki-download_file.php


Changes:

=====================================
lib/core/Services/File/Utilities.php
=====================================
@@ -86,4 +86,95 @@ class Services_File_Utilities
             $permissionApplier->apply($perms);
         }
     }
+
+    /**
+     * Enforces the full permission policy for displaying or downloading a file:
+     * - bypasses all checks when the request carries a valid auth token
+     * - honors `backlinkPerms` together with `hasOnlyPrivateBacklinks`
+     * - grants access via wiki-page attachment perms when the file lives in an attachments gallery
+     * - grants access via a viewable backlinked tracker item
+     * - enforces user-file-gallery privacy
+     * - verifies download perms on `?thumbnail=<id>` too, when present
+     *
+     * @param array  $file
+     * @param bool   $zip
+     */
+    public function enforceFileDownloadPermissions(array $file, bool $zip = false): void
+    {
+        global $user, $is_token_access, $prefs;
+
+        if ($prefs['auth_token_access'] == 'y' && $is_token_access) {
+            return;
+        }
+
+        $access = TikiLib::lib('access');
+        $filegallib = TikiLib::lib('filegal');
+        $userlib = TikiLib::lib('user');
+
+        $can_admin_file_galleries = Perms::get()->admin_file_galleries;
+
+        if (! $can_admin_file_galleries && $file['backlinkPerms'] == 'y' && $filegallib->hasOnlyPrivateBacklinks($file['fileId'])) {
+            $this->rememberLoginReferer();
+            $access->display_error('', tra('Permission denied'), 401);
+        }
+
+        $gal_info = null;
+        $attachment_perms = false;
+        if ($prefs['feature_use_fgal_for_wiki_attachments'] === 'y' && ! $can_admin_file_galleries) {
+            $gal_info = $filegallib->get_file_gallery_info($file['galleryId']);
+            if ($gal_info['type'] == 'attachments') {
+                $perms = Perms::get(['object' => $gal_info['name'], 'type' => 'wiki page']);
+                if (($perms->view && $perms->wiki_view_attachments) || $perms->wiki_admin_attachments) {
+                    $attachment_perms = true;
+                }
+            }
+        }
+
+        if (
+            ! $zip
+            && ! $attachment_perms
+            && ! $can_admin_file_galleries
+            && ! $userlib->user_has_perm_on_object($user, $file['fileId'], 'file', 'tiki_p_download_files')
+            && ! $filegallib->isBacklinkedFromAViewableTrackerItem($file['fileId'])
+        ) {
+            $this->rememberLoginReferer();
+            $access->display_error('', tra('Permission denied'), 401);
+        }
+
+        // When a thumbnail is requested via ?thumbnail=<fileId>, verify download perms on the thumb too
+        if (isset($_GET['thumbnail']) && is_numeric($_GET['thumbnail'])) {
+            $info_thumb = $filegallib->get_file($_GET['thumbnail']);
+            if (
+                ! $zip
+                && ! $attachment_perms
+                && ! $can_admin_file_galleries
+                && ! $userlib->user_has_perm_on_object($user, $info_thumb['fileId'], 'file', 'tiki_p_download_files')
+            ) {
+                $this->rememberLoginReferer();
+                $access->display_error('', tra('Permission denied'), 401);
+            }
+        }
+
+        if ($prefs['feature_use_fgal_for_user_files'] === 'y' && ! $can_admin_file_galleries && $prefs['userfiles_private'] === 'y') {
+            if ($gal_info === null) {
+                $gal_info = $filegallib->get_file_gallery_info($file['galleryId']);
+            }
+            if ($gal_info['type'] === 'user' && $gal_info['visible'] !== 'y' && $gal_info['user'] !== $user) {
+                $access->display_error('', tra('Permission denied'), 401);
+            }
+        }
+    }
+
+    /**
+     * Stash the referer so that, after login, the user is returned to the page
+     * they were originally trying to reach.
+     */
+    private function rememberLoginReferer(): void
+    {
+        global $user, $prefs;
+
+        if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
+            $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'] ?? '';
+        }
+    }
 }


=====================================
tiki-display.php
=====================================
@@ -8,7 +8,6 @@ use Tiki\File\FileHelper;
 
 require_once('tiki-setup.php');
 
-global $user;
 $accesslib = TikiLib::lib('access');
 $accesslib->check_feature('feature_file_galleries');
 
@@ -25,9 +24,8 @@ if (is_null($file)) {
     $accesslib->display_error('tiki-display.php', tr(sprintf('File ID %s not found.', $fileId)));
 }
 
-if (! $tikilib->user_has_perm_on_object($user, $fileId, 'file', 'tiki_p_download_files')) {
-    $accesslib->display_error('tiki-display.php', tr('You do not have permission to view this file'), 403);
-}
+$utilities = new Services_File_Utilities();
+$utilities->enforceFileDownloadPermissions($file);
 
 $data = $file['data'];
 $templatePath = FileHelper::getDisplayTemplate($file, $data, true);


=====================================
tiki-download_file.php
=====================================
@@ -99,49 +99,8 @@ if (! $skip) {
     if (! is_array($info)) {
         $access->display_error(null, tra('File has been deleted'), 404);
     }
-    if ($prefs['auth_token_access'] != 'y' || ! $is_token_access) {
-        // Check permissions except if the user comes with a valid Token
-
-        if ($tiki_p_admin_file_galleries != 'y' && $info['backlinkPerms'] == 'y' && $filegallib->hasOnlyPrivateBacklinks($info['fileId'])) {
-            if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
-                $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'];
-            }
-            $access->display_error('', tra('Permission denied'), 401);
-        }
-
-        $attachment_perms = false;
-        if ($prefs['feature_use_fgal_for_wiki_attachments'] === 'y' && $tiki_p_admin_file_galleries !== 'y') {
-            $gal_info = $filegallib->get_file_gallery_info($info['galleryId']);
-            if ($gal_info['type'] == 'attachments') {
-                $perms = Perms::get(['object' => $gal_info['name'], 'type' => 'wiki page']);
-                if (($perms->view && $perms->wiki_view_attachments) || $perms->wiki_admin_attachments) {
-                    $attachment_perms = true;
-                }
-            }
-        }
-
-        if (! $zip && ! $attachment_perms && $tiki_p_admin_file_galleries != 'y' && ! $userlib->user_has_perm_on_object($user, $info['fileId'], 'file', 'tiki_p_download_files') && ! $filegallib->isBacklinkedFromAViewableTrackerItem($info['fileId'])) {
-            if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
-                $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'];
-            }
-            $access->display_error('', tra('Permission denied'), 401);
-        }
-        if (isset($_GET['thumbnail']) && is_numeric($_GET['thumbnail'])) { //check also perms on thumb
-            $info_thumb = $filegallib->get_file($_GET['thumbnail']);
-            if (! $zip && ! $attachment_perms && $tiki_p_admin_file_galleries != 'y' && ! $userlib->user_has_perm_on_object($user, $info_thumb['fileId'], 'file', 'tiki_p_download_files')) {
-                if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
-                    $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'];
-                }
-                $access->display_error('', tra('Permission denied'), 401);
-            }
-        }
-        if ($prefs['feature_use_fgal_for_user_files'] === 'y' && $tiki_p_admin_file_galleries !== 'y' && $prefs['userfiles_private'] === 'y') {
-            $gal_info = $filegallib->get_file_gallery_info($info['galleryId']);
-            if ($gal_info['type'] === 'user' && $gal_info['visible'] !== 'y' && $gal_info['user'] !== $user) {
-                $access->display_error('', tra('Permission denied'), 401);
-            }
-        }
-    }
+    $utilities = new Services_File_Utilities();
+    $utilities->enforceFileDownloadPermissions($info, $zip);
 }
 
 //if the file is remote, display, and don't cache
@@ -389,9 +348,7 @@ if (isset($_GET['preview']) || isset($_GET['thumbnail']) || isset($_GET['display
                     } elseif (isset($_GET['thumbnail'])) {
                     // We resize to a thumbnail size if needed
                         if (is_numeric($_GET['thumbnail'])) {
-                            if (empty($info_thumb)) {
-                                $info_thumb = $filegallib->get_file($_GET['thumbnail']);
-                            }
+                            $info_thumb = $filegallib->get_file($_GET['thumbnail']);
                             $file_thumb = new \Tiki\TikiFile\File($info_thumb);
                             $image = Image::create($file_thumb->getContents());
                             $content = null; // Explicitely free memory before getting cache



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/449346d1536603ff41c9d061e28f47b655ec9982

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/449346d1536603ff41c9d061e28f47b655ec9982
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs