[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [FIX] download and preview file unified permission checks

Victor Emanouilov pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
1e3d506d by Victor Emanouilov at 2026-04-21T14:05:02+03:00
[FIX] download and preview file unified permission checks

- - - - -


3 changed files:

- lib/core/Services/File/Utilities.php
- tiki-display.php
- tiki-download_file.php


Changes:

=====================================
lib/core/Services/File/Utilities.php
=====================================
@@ -42,4 +42,78 @@ class Services_File_Utilities
         $filegallib = TikiLib::lib('filegal');
         return $filegallib->update_single_file($gal_info, $name, $size, $type, $data, $fileId, $asuser, $title);
     }
+
+    /**
+     * Enforces the full permission policy for displaying or downloading a file:
+     * - bypasses all checks when the request carries a valid auth token
+     * - honors `backlinkPerms` together with `hasOnlyPrivateBacklinks`
+     * - grants access via a viewable backlinked tracker item
+     * - enforces user-file-gallery privacy
+     * - verifies download perms on `?thumbnail=<id>` too, when present
+     *
+     * @param array  $file
+     * @param bool   $zip
+     */
+    public function enforceFileDownloadPermissions(array $file, bool $zip = false): void
+    {
+        global $user, $is_token_access, $prefs;
+
+        if ($prefs['auth_token_access'] == 'y' && $is_token_access) {
+            return;
+        }
+
+        $access = TikiLib::lib('access');
+        $filegallib = TikiLib::lib('filegal');
+        $userlib = TikiLib::lib('user');
+
+        $can_admin_file_galleries = Perms::get()->admin_file_galleries;
+
+        if (! $can_admin_file_galleries && $file['backlinkPerms'] == 'y' && $filegallib->hasOnlyPrivateBacklinks($file['fileId'])) {
+            $this->rememberLoginReferer();
+            $access->display_error('', tra('Permission denied'), 401);
+        }
+
+        if (
+            ! $zip
+            && ! $can_admin_file_galleries
+            && ! $userlib->user_has_perm_on_object($user, $file['fileId'], 'file', 'tiki_p_download_files')
+            && ! $filegallib->isBacklinkedFromAViewableTrackerItem($file['fileId'])
+        ) {
+            $this->rememberLoginReferer();
+            $access->display_error('', tra('Permission denied'), 401);
+        }
+
+        // When a thumbnail is requested via ?thumbnail=<fileId>, verify download perms on the thumb too
+        if (isset($_GET['thumbnail']) && is_numeric($_GET['thumbnail'])) {
+            $info_thumb = $filegallib->get_file($_GET['thumbnail']);
+            if (
+                ! $zip
+                && ! $can_admin_file_galleries
+                && ! $userlib->user_has_perm_on_object($user, $info_thumb['fileId'], 'file', 'tiki_p_download_files')
+            ) {
+                $this->rememberLoginReferer();
+                $access->display_error('', tra('Permission denied'), 401);
+            }
+        }
+
+        if ($prefs['feature_use_fgal_for_user_files'] === 'y' && ! $can_admin_file_galleries && $prefs['userfiles_private'] === 'y') {
+            $gal_info = $filegallib->get_file_gallery_info($file['galleryId']);
+            if ($gal_info['type'] === 'user' && $gal_info['visible'] !== 'y' && $gal_info['user'] !== $user) {
+                $access->display_error('', tra('Permission denied'), 401);
+            }
+        }
+    }
+
+    /**
+     * Stash the referer so that, after login, the user is returned to the page
+     * they were originally trying to reach.
+     */
+    private function rememberLoginReferer(): void
+    {
+        global $user, $prefs;
+
+        if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
+            $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'] ?? '';
+        }
+    }
 }


=====================================
tiki-display.php
=====================================
@@ -11,7 +11,6 @@ use Tiki\File\FileHelper;
 
 require_once('tiki-setup.php');
 
-global $user;
 $accesslib = TikiLib::lib('access');
 $accesslib->check_feature('feature_file_galleries');
 
@@ -28,9 +27,8 @@ if (is_null($file)) {
     $accesslib->display_error('tiki-display.php', tr(sprintf('File ID %s not found.', $fileId)));
 }
 
-if (! $tikilib->user_has_perm_on_object($user, $fileId, 'file', 'tiki_p_download_files')) {
-    $accesslib->display_error('tiki-display.php', tr('You do not have permission to view this file'), 403);
-}
+$utilities = new Services_File_Utilities();
+$utilities->enforceFileDownloadPermissions($file);
 
 $data = $file['data'];
 $templatePath = FileHelper::getDisplayTemplate($file, $data, true);


=====================================
tiki-download_file.php
=====================================
@@ -73,38 +73,8 @@ if (! $skip) {
     if (! is_array($info)) {
         $access->display_error(null, tra('File has been deleted'), 404);
     }
-    if ($prefs['auth_token_access'] != 'y' || ! $is_token_access) {
-        // Check permissions except if the user comes with a valid Token
-
-        if ($tiki_p_admin_file_galleries != 'y' && $info['backlinkPerms'] == 'y' && $filegallib->hasOnlyPrivateBacklinks($info['fileId'])) {
-            if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
-                $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'];
-            }
-            $access->display_error('', tra('Permission denied'), 401);
-        }
-
-        if (! $zip && $tiki_p_admin_file_galleries != 'y' && ! $userlib->user_has_perm_on_object($user, $info['fileId'], 'file', 'tiki_p_download_files') && ! $filegallib->isBacklinkedFromAViewableTrackerItem($info['fileId'])) {
-            if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
-                $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'];
-            }
-            $access->display_error('', tra('Permission denied'), 401);
-        }
-        if (isset($_GET['thumbnail']) && is_numeric($_GET['thumbnail'])) { //check also perms on thumb
-            $info_thumb = $filegallib->get_file($_GET['thumbnail']);
-            if (! $zip && $tiki_p_admin_file_galleries != 'y' && ! $userlib->user_has_perm_on_object($user, $info_thumb['fileId'], 'file', 'tiki_p_download_files')) {
-                if (! $user && $prefs['permission_denied_login_box'] === 'y' && empty($_SESSION['loginfrom'])) {
-                    $_SESSION['loginfrom'] = $_SERVER['HTTP_REFERER'];
-                }
-                $access->display_error('', tra('Permission denied'), 401);
-            }
-        }
-        if ($prefs['feature_use_fgal_for_user_files'] === 'y' && $tiki_p_admin_file_galleries !== 'y' && $prefs['userfiles_private'] === 'y') {
-            $gal_info = $filegallib->get_file_gallery_info($info['galleryId']);
-            if ($gal_info['type'] === 'user' && $gal_info['visible'] !== 'y' && $gal_info['user'] !== $user) {
-                $access->display_error('', tra('Permission denied'), 401);
-            }
-        }
-    }
+    $utilities = new Services_File_Utilities();
+    $utilities->enforceFileDownloadPermissions($info, $zip);
 }
 
 //if the file is remote, display, and don't cache
@@ -338,9 +308,7 @@ if (isset($_GET['preview']) || isset($_GET['thumbnail']) || isset($_GET['display
                     } elseif (isset($_GET['thumbnail'])) {
                     // We resize to a thumbnail size if needed
                         if (is_numeric($_GET['thumbnail'])) {
-                            if (empty($info_thumb)) {
-                                $info_thumb = $filegallib->get_file($_GET['thumbnail']);
-                            }
+                            $info_thumb = $filegallib->get_file($_GET['thumbnail']);
                             $file_thumb = new \Tiki\TikiFile\File($info_thumb);
                             $image = Image::create($file_thumb->getContents());
                             $content = null; // Explicitely free memory before getting cache



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/1e3d506d977bd0754cbab869025bfe2c348375d0

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/1e3d506d977bd0754cbab869025bfe2c348375d0
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs