From 6a1631ef262090b69ba6b6ca96d119290e06cf20 Mon Sep 17 00:00:00 2001 From: Jonas Date: Tue, 3 Nov 2026 16:25:43 +0100 Subject: [PATCH 1/2] fix(sessions): only use share node matching the session document getFileForSession() returned the node of a single-file share without checking it against the session's document, so the share token passed with push, sync and save could belong to a different file. Require the resolved file id to match the session document id. Alaready fixed in stable35 and above, where getFileByIdFromShare() does the same check, as part of #9062. Signed-off-by: Jonas Assisted-by: ClaudeCode:claude-opus-5-5 --- lib/Service/DocumentService.php | 2 +- tests/unit/Service/DocumentServiceTest.php | 29 ++++++++++++++++++++++ 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/lib/Service/DocumentService.php b/lib/Service/DocumentService.php index 2c4dcbd85c1..397b460c2df 100644 --- a/lib/Service/DocumentService.php +++ b/lib/Service/DocumentService.php @@ -508,7 +508,7 @@ public function getFileForSession(Session $session, ?string $shareToken = null): if ($node instanceof Folder) { $node = $node->getFirstNodeById($session->getDocumentId()); } - if ($node instanceof File) { + if ($node instanceof File && $node->getId() === $session->getDocumentId()) { return $node; } throw new \InvalidArgumentException('No proper share data'); diff --git a/tests/unit/Service/DocumentServiceTest.php b/tests/unit/Service/DocumentServiceTest.php index 8d091f2564f..dea1ddab808 100644 --- a/tests/unit/Service/DocumentServiceTest.php +++ b/tests/unit/Service/DocumentServiceTest.php @@ -3,11 +3,13 @@ namespace OCA\Text\Tests; use OCA\Text\Db\DocumentMapper; +use OCA\Text\Db\Session; use OCA\Text\Db\SessionMapper; use OCA\Text\Db\StepMapper; use OCA\Text\Service\DocumentService; use OCP\Constants; use OCP\Files\Config\IUserMountCache; +use OCP\Files\File; use OCP\Files\Folder; use OCP\Files\IAppData; use OCP\Files\IRootFolder; @@ -17,6 +19,7 @@ use OCP\IConfig; use OCP\IRequest; use OCP\Share\IManager; +use OCP\Share\IShare; use Psr\Log\LoggerInterface; class DocumentServiceTest extends \PHPUnit\Framework\TestCase { @@ -104,4 +107,30 @@ public function testGetFileByIdNoRead() { $this->expectException(NotPermittedException::class); $actual = $this->documentService->getFileById(1234); } + + public function testGetFileForSessionFromShare() { + $file = $this->createMock(File::class); + $file->method('getId')->willReturn(1234); + $share = $this->createMock(IShare::class); + $share->method('getNode')->willReturn($file); + $this->shareManager->method('getShareByToken')->willReturn($share); + + $session = new Session(); + $session->setDocumentId(1234); + $actual = $this->documentService->getFileForSession($session, 'shareToken'); + self::assertEquals($file, $actual); + } + + public function testGetFileForSessionFromShareOfOtherFile() { + $file = $this->createMock(\OCP\Files\File::class); + $file->method('getId')->willReturn(5678); + $share = $this->createMock(IShare::class); + $share->method('getNode')->willReturn($file); + $this->shareManager->method('getShareByToken')->willReturn($share); + + $session = new Session(); + $session->setDocumentId(1234); + $this->expectException(\InvalidArgumentException::class); + $this->documentService->getFileForSession($session, 'shareToken'); + } } From 7321db993b9bd79a5abf2a8498b1d32e8464f30e Mon Sep 17 00:00:00 2001 From: Jonas Date: Wed, 4 Nov 2026 10:04:15 +0100 Subject: [PATCH 2/2] fix(deps): bump playwright to 1.64.1 Lower versions don't work on ubuntu-24.02 runners. Signed-off-by: Jonas Assisted-by: ClaudeCode:claude-opus-5-5 --- package-lock.json | 92 +++++++++++++++++------------------------------ package.json | 2 +- 2 files changed, 33 insertions(+), 61 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9aa038aca0b..21c5edc8af8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -98,7 +98,7 @@ "@nextcloud/eslint-config": "^8.4.2", "@nextcloud/prettier-config": "^1.2.0", "@nextcloud/vite-config": "^1.7.2", - "@playwright/test": "^1.58.2", + "@playwright/test": "^1.64.1", "@types/markdown-it": "^14.1.2", "@vitejs/plugin-vue2": "^2.3.4", "@vitest/coverage-v8": "^3.2.7", @@ -4409,19 +4409,19 @@ } }, "node_modules/@playwright/test": { - "version": "1.58.2", - "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz", - "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==", + "version": "1.64.1", + "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.64.1.tgz", + "integrity": "sha512-IaYGml/nSOiZWROfPtuIL7neuu9qDOZ3TNvNljUIrhDMxiGTgPjzj/g9p9RxpS2tSepPDRY+UwAaEeiKtUvIAg==", "dev": true, "license": "Apache-2.0", "dependencies": { - "playwright": "1.58.2" + "playwright": "1.64.1" }, "bin": { "playwright": "cli.js" }, "engines": { - "node": ">=18" + "node": ">=20" } }, "node_modules/@popperjs/core": { @@ -15953,50 +15953,32 @@ } }, "node_modules/playwright": { - "version": "1.58.2", - "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz", - "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==", + "version": "1.64.1", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.64.1.tgz", + "integrity": "sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==", "dev": true, "license": "Apache-2.0", "dependencies": { - "playwright-core": "1.58.2" + "playwright-core": "1.64.1" }, "bin": { "playwright": "cli.js" }, "engines": { - "node": ">=18" - }, - "optionalDependencies": { - "fsevents": "2.3.2" + "node": ">=20" } }, "node_modules/playwright-core": { - "version": "1.58.2", - "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz", - "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==", + "version": "1.64.1", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.1.tgz", + "integrity": "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==", "dev": true, "license": "Apache-2.0", "bin": { "playwright-core": "cli.js" }, "engines": { - "node": ">=18" - } - }, - "node_modules/playwright/node_modules/fsevents": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz", - "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==", - "dev": true, - "hasInstallScript": true, - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": "^8.16.0 || ^10.6.0 || >=11.0.0" + "node": ">=20" } }, "node_modules/pluralize": { @@ -17543,9 +17525,9 @@ } }, "node_modules/rollup-plugin-license/node_modules/picomatch": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz", - "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==", + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "license": "MIT", "optional": true, @@ -24148,12 +24130,12 @@ "dev": true }, "@playwright/test": { - "version": "1.58.2", - "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz", - "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==", + "version": "1.64.1", + "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.64.1.tgz", + "integrity": "sha512-IaYGml/nSOiZWROfPtuIL7neuu9qDOZ3TNvNljUIrhDMxiGTgPjzj/g9p9RxpS2tSepPDRY+UwAaEeiKtUvIAg==", "dev": true, "requires": { - "playwright": "1.58.2" + "playwright": "1.64.1" } }, "@popperjs/core": { @@ -31952,28 +31934,18 @@ } }, "playwright": { - "version": "1.58.2", - "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz", - "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==", + "version": "1.64.1", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.64.1.tgz", + "integrity": "sha512-HCrVhHr5QQuwYoswEUGTb7gGp522yflbv/ST8nF4sFWGuLjQCt17Q/EubpGGSNKYn1tsTCPZxqHhHCfVURu7UA==", "dev": true, "requires": { - "fsevents": "2.3.2", - "playwright-core": "1.58.2" - }, - "dependencies": { - "fsevents": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz", - "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==", - "dev": true, - "optional": true - } + "playwright-core": "1.64.1" } }, "playwright-core": { - "version": "1.58.2", - "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz", - "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==", + "version": "1.64.1", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.1.tgz", + "integrity": "sha512-BC4s8y6SEVA6Q1rSxZTto8hI1KUI3xXlHGZgvGqP4IqPdI/a6FX9H29IDNz7vKo9l21b6LfYosScPL6M3xxyDQ==", "dev": true }, "pluralize": { @@ -33116,9 +33088,9 @@ "requires": {} }, "picomatch": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz", - "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==", + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "optional": true, "peer": true diff --git a/package.json b/package.json index 013dd823bcb..644356c8ee6 100644 --- a/package.json +++ b/package.json @@ -118,7 +118,7 @@ "@nextcloud/eslint-config": "^8.4.2", "@nextcloud/prettier-config": "^1.2.0", "@nextcloud/vite-config": "^1.7.2", - "@playwright/test": "^1.58.2", + "@playwright/test": "^1.64.1", "@types/markdown-it": "^14.1.2", "@vitejs/plugin-vue2": "^2.3.4", "@vitest/coverage-v8": "^3.2.7",