Forbidden overwrite in public links with drop zone

changelog/unreleased/drop-zone-collision.md

@@ -0,0 +1,5 @@
+Enhancement: Append a timestamp to filename when
+a collision is detected during upload
+
+https://github.com/cs3org/reva/issues/2480
+https://github.com/cs3org/reva/pull/2510

internal/http/services/owncloud/ocdav/put.go

@@ -26,11 +26,13 @@ import (
 	"strings"
 	"time"
 
+	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	typespb "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
 	"github.com/cs3org/reva/internal/http/services/datagateway"
 	"github.com/cs3org/reva/pkg/appctx"
+	ctxpkg "github.com/cs3org/reva/pkg/ctx"
 	"github.com/cs3org/reva/pkg/errtypes"
 	"github.com/cs3org/reva/pkg/rhttp"
 	"github.com/cs3org/reva/pkg/storage/utils/chunking"
@@ -149,6 +151,24 @@ func (s *svc) handlePut(ctx context.Context, w http.ResponseWriter, r *http.Requ
 		return
 	}
 
+	if sRes.Status.Code == rpc.Code_CODE_OK {
+		// the file already exists
+		// will append a timestamp to the end of the file
+		// sorry, this code is not atomic, data loss may occur :'(
+
+		user, ok := ctxpkg.ContextGetUser(ctx)
+		if !ok {
+			log.Error().Msg("error getting user from context")
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		if hasUploaderRole(user) {
+			ref.Path = utils.AppendNowToPath(ref.Path)
+			log.Debug().Str("user", user.Username).Str("path", ref.Path).Msg("user has uploader role, changed file name")
+		}
+	}
+
 	info := sRes.Info
 	if info != nil {
 		if info.Type != provider.ResourceType_RESOURCE_TYPE_FILE {
@@ -331,6 +351,17 @@ func (s *svc) handlePut(ctx context.Context, w http.ResponseWriter, r *http.Requ
 	w.WriteHeader(http.StatusNoContent)
 }
 
+func hasUploaderRole(user *userpb.User) bool {
+	if user.Opaque == nil {
+		return false
+	}
+	publicShare, ok := user.Opaque.Map["public-share-role"]
+	if !ok {
+		return false
+	}
+	return string(publicShare.Value) == "uploader"
+}
+
 func (s *svc) handleSpacesPut(w http.ResponseWriter, r *http.Request, spaceID string) {
 	ctx, span := rtrace.Provider.Tracer("ocdav").Start(r.Context(), "spaces_put")
 	defer span.End()

internal/http/services/owncloud/ocdav/tus.go

@@ -33,6 +33,7 @@ import (
 	typespb "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
 	"github.com/cs3org/reva/internal/http/services/owncloud/ocs/conversions"
 	"github.com/cs3org/reva/pkg/appctx"
+	ctxpkg "github.com/cs3org/reva/pkg/ctx"
 	"github.com/cs3org/reva/pkg/rhttp"
 	rtrace "github.com/cs3org/reva/pkg/trace"
 	"github.com/cs3org/reva/pkg/utils"
@@ -138,6 +139,24 @@ func (s *svc) handleTusPost(ctx context.Context, w http.ResponseWriter, r *http.
 		return
 	}
 
+	if sRes.Status.Code == rpc.Code_CODE_OK {
+		// the file already exists
+		// will append a timestamp to the end of the file
+		// sorry, this code is not atomic, data loss may occur :'(
+
+		user, ok := ctxpkg.ContextGetUser(ctx)
+		if !ok {
+			log.Error().Msg("error getting user from context")
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		if hasUploaderRole(user) {
+			ref.Path = utils.AppendNowToPath(ref.Path)
+			log.Debug().Str("user", user.Username).Str("path", ref.Path).Msg("user has uploader role, changed file name")
+		}
+	}
+
 	info := sRes.Info
 	if info != nil && info.Type != provider.ResourceType_RESOURCE_TYPE_FILE {
 		log.Warn().Msg("resource is not a file")

pkg/utils/utils.go

@@ -352,3 +352,11 @@ func GetViewMode(viewMode string) gateway.OpenInAppRequest_ViewMode {
 		return gateway.OpenInAppRequest_VIEW_MODE_INVALID
 	}
 }
+
+// AppendNowToPath appends the now timestamp just before the extension (if present)
+func AppendNowToPath(p string) string {
+	now := time.Now().Format("2006-01-02T15.04.05")
+	ext := path.Ext(p)
+	baseFile := strings.TrimSuffix(p, ext)
+	return fmt.Sprintf("%s.%s%s", baseFile, now, ext)
+}