From 8315891418c8abad9b87838b52f3c95f5549ee56 Mon Sep 17 00:00:00 2001
From: Roeland Jago Douma <roeland@famdouma.nl>
Date: Mon, 14 Nov 2016 15:42:36 +0100
Subject: [PATCH 1/2] [Stable10] Fixes not allowed increasing of link share
 permissions

Backport of #2100

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
---
 apps/files_sharing/lib/API/Share20OCS.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/files_sharing/lib/API/Share20OCS.php b/apps/files_sharing/lib/API/Share20OCS.php
index 23ebe4871ccef..ac7793983a132 100644
--- a/apps/files_sharing/lib/API/Share20OCS.php
+++ b/apps/files_sharing/lib/API/Share20OCS.php
@@ -637,6 +637,7 @@ public function updateShare($id) {
 
 			if ($newPermissions !== null) {
 				$share->setPermissions($newPermissions);
+				$permissions = $newPermissions;
 			}
 
 			if ($expireDate === '') {

From 5039b37570cf733e26d819e7396f6501517236e7 Mon Sep 17 00:00:00 2001
From: Roeland Jago Douma <roeland@famdouma.nl>
Date: Tue, 15 Nov 2016 09:12:42 +0100
Subject: [PATCH 2/2] Fix tests

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
---
 .../tests/API/Share20OCSTest.php              | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/apps/files_sharing/tests/API/Share20OCSTest.php b/apps/files_sharing/tests/API/Share20OCSTest.php
index 90986fc0c349a..683377a09701d 100644
--- a/apps/files_sharing/tests/API/Share20OCSTest.php
+++ b/apps/files_sharing/tests/API/Share20OCSTest.php
@@ -1334,6 +1334,9 @@ public function testUpdateLinkShareClear() {
 			})
 		)->will($this->returnArgument(0));
 
+		$this->shareManager->method('getSharedWith')
+			->willReturn([]);
+
 		$expected = new \OC_OCS_Result(null);
 		$result = $ocs->updateShare(42);
 
@@ -1374,6 +1377,9 @@ public function testUpdateLinkShareSet() {
 			})
 		)->will($this->returnArgument(0));
 
+		$this->shareManager->method('getSharedWith')
+			->willReturn([]);
+
 		$expected = new \OC_OCS_Result(null);
 		$result = $ocs->updateShare(42);
 
@@ -1650,6 +1656,9 @@ public function testUpdateLinkSharePublicUploadDoesNotChangeOther() {
 			})
 		)->will($this->returnArgument(0));
 
+		$this->shareManager->method('getSharedWith')
+			->willReturn([]);
+
 		$expected = new \OC_OCS_Result(null);
 		$result = $ocs->updateShare(42);
 
@@ -1819,6 +1828,52 @@ public function testUpdateShareCannotIncreasePermissions() {
 		$this->assertEquals($expected->getData(), $result->getData());
 	}
 
+	public function testUpdateShareCannotIncreasePermissionsLinkShare() {
+		$ocs = $this->mockFormatShare();
+		$folder = $this->getMockBuilder('OCP\Files\Folder')
+			->getMock();
+		$share = \OC::$server->getShareManager()->newShare();
+		$share
+			->setId(42)
+			->setSharedBy($this->currentUser->getUID())
+			->setShareOwner('anotheruser')
+			->setShareType(\OCP\Share::SHARE_TYPE_LINK)
+			->setPermissions(\OCP\Constants::PERMISSION_READ)
+			->setNode($folder);
+		// note: updateShare will modify the received instance but getSharedWith will reread from the database,
+		// so their values will be different
+		$incomingShare = \OC::$server->getShareManager()->newShare();
+		$incomingShare
+			->setId(42)
+			->setSharedBy($this->currentUser->getUID())
+			->setShareOwner('anotheruser')
+			->setShareType(\OCP\Share::SHARE_TYPE_USER)
+			->setSharedWith('currentUser')
+			->setPermissions(\OCP\Constants::PERMISSION_READ)
+			->setNode($folder);
+		$this->shareManager->method('getShareById')->with('ocinternal:42')->willReturn($share);
+		$this->shareManager->expects($this->any())
+			->method('getSharedWith')
+			->will($this->returnValueMap([
+				['currentUser', \OCP\Share::SHARE_TYPE_USER, $share->getNode(), -1, 0, [$incomingShare]],
+				['currentUser', \OCP\Share::SHARE_TYPE_GROUP, $share->getNode(), -1, 0, []]
+			]));
+		$this->shareManager->expects($this->never())->method('updateShare');
+		$this->shareManager->method('shareApiLinkAllowPublicUpload')->willReturn(true);
+
+		$this->request
+			->method('getParam')
+			->will($this->returnValueMap([
+				['publicUpload', null, 'true'],
+			]));
+
+		$expected = new \OC_OCS_Result(null, 404, 'Cannot increase permissions');
+		$result = $ocs->updateShare(42);
+
+		$this->assertEquals($expected->getMeta(), $result->getMeta());
+		$this->assertEquals($expected->getData(), $result->getData());
+	}
+
 	public function testUpdateShareCanIncreasePermissionsIfOwner() {
 		$ocs = $this->mockFormatShare();