From: Sandro Knauß Date: Sun, 5 Jan 2025 22:18:59 +0000 (+0100) Subject: Another backport to proper fix #1091614. X-Git-Tag: archive/raspbian/3.16.7-1_deb13u1+rpi1~1^2~42 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=b212cbe9b6531433c57eb5a9a4acb7684da681f6;p=nextcloud-desktop.git Another backport to proper fix #1091614. --- diff --git a/debian/patches/0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch b/debian/patches/0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch new file mode 100644 index 000000000..ca6882e7d --- /dev/null +++ b/debian/patches/0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch @@ -0,0 +1,182 @@ +From: =?utf-8?q?Sandro_Knau=C3=9F?= +Date: Sun, 5 Jan 2025 23:17:28 +0100 +Subject: Revert "ensure no any user writable permissions in Nextcloud sync + folder" + +This reverts commit 5b2af166d3d9c8537c565922750392d4a3f6610e. +--- + src/csync/csync.h | 2 -- + src/csync/vio/csync_vio_local_unix.cpp | 2 -- + src/libsync/discovery.cpp | 11 ----------- + src/libsync/discoveryphase.cpp | 1 - + src/libsync/discoveryphase.h | 1 - + src/libsync/filesystem.cpp | 1 - + src/libsync/owncloudpropagator.cpp | 14 +++++++++++--- + src/libsync/syncengine.cpp | 4 ---- + src/libsync/syncfileitem.h | 2 -- + 9 files changed, 11 insertions(+), 27 deletions(-) + +diff --git a/src/csync/csync.h b/src/csync/csync.h +index 9da7497..5c8fbc0 100644 +--- a/src/csync/csync.h ++++ b/src/csync/csync.h +@@ -217,7 +217,6 @@ struct OCSYNC_EXPORT csync_file_stat_s { + bool is_hidden BITFIELD(1); // Not saved in the DB, only used during discovery for local files. + bool isE2eEncrypted BITFIELD(1); + bool is_metadata_missing BITFIELD(1); // Indicates the file has missing metadata, f.ex. the file is not a placeholder in case of vfs. +- bool isPermissionsInvalid BITFIELD(1); + + QByteArray path; + QByteArray rename_path; +@@ -245,7 +244,6 @@ struct OCSYNC_EXPORT csync_file_stat_s { + , is_hidden(false) + , isE2eEncrypted(false) + , is_metadata_missing(false) +- , isPermissionsInvalid(false) + { } + }; + +diff --git a/src/csync/vio/csync_vio_local_unix.cpp b/src/csync/vio/csync_vio_local_unix.cpp +index ec47ab3..c5e22ab 100644 +--- a/src/csync/vio/csync_vio_local_unix.cpp ++++ b/src/csync/vio/csync_vio_local_unix.cpp +@@ -170,7 +170,5 @@ static int _csync_vio_local_stat_mb(const mbchar_t *wuri, csync_file_stat_t *buf + buf->inode = sb.st_ino; + buf->modtime = sb.st_mtime; + buf->size = sb.st_size; +- buf->isPermissionsInvalid = (sb.st_mode & S_IWOTH) == S_IWOTH; +- + return 0; + } +diff --git a/src/libsync/discovery.cpp b/src/libsync/discovery.cpp +index e842f82..fc92795 100644 +--- a/src/libsync/discovery.cpp ++++ b/src/libsync/discovery.cpp +@@ -1070,10 +1070,6 @@ void ProcessDirectoryJob::processFileAnalyzeLocalInfo( + if (_queryLocal != NormalQuery && _queryServer != NormalQuery) + recurse = false; + +- if (localEntry.isPermissionsInvalid) { +- recurse = true; +- } +- + if ((item->_direction == SyncFileItem::Down || item->_instruction == CSYNC_INSTRUCTION_CONFLICT || item->_instruction == CSYNC_INSTRUCTION_NEW || item->_instruction == CSYNC_INSTRUCTION_SYNC) && + (item->_modtime <= 0 || item->_modtime >= 0xFFFFFFFF)) { + item->_instruction = CSYNC_INSTRUCTION_ERROR; +@@ -1101,13 +1097,6 @@ void ProcessDirectoryJob::processFileAnalyzeLocalInfo( + } + } + +- if (localEntry.isPermissionsInvalid && item->_instruction == CSyncEnums::CSYNC_INSTRUCTION_NONE) { +- item->_instruction = CSYNC_INSTRUCTION_UPDATE_METADATA; +- item->_direction = SyncFileItem::Down; +- } +- +- item->isPermissionsInvalid = localEntry.isPermissionsInvalid; +- + auto recurseQueryLocal = _queryLocal == ParentNotChanged ? ParentNotChanged : localEntry.isDirectory || item->_instruction == CSYNC_INSTRUCTION_RENAME ? NormalQuery : ParentDontExist; + processFileFinalize(item, path, recurse, recurseQueryLocal, recurseQueryServer); + }; +diff --git a/src/libsync/discoveryphase.cpp b/src/libsync/discoveryphase.cpp +index 6cd226f..3ca34e9 100644 +--- a/src/libsync/discoveryphase.cpp ++++ b/src/libsync/discoveryphase.cpp +@@ -348,7 +348,6 @@ void DiscoverySingleLocalDirectoryJob::run() { + i.isSymLink = dirent->type == ItemTypeSoftLink; + i.isVirtualFile = dirent->type == ItemTypeVirtualFile || dirent->type == ItemTypeVirtualFileDownload; + i.isMetadataMissing = dirent->is_metadata_missing; +- i.isPermissionsInvalid = dirent->isPermissionsInvalid; + i.type = dirent->type; + results.push_back(i); + } +diff --git a/src/libsync/discoveryphase.h b/src/libsync/discoveryphase.h +index bb932f5..2e801de 100644 +--- a/src/libsync/discoveryphase.h ++++ b/src/libsync/discoveryphase.h +@@ -106,7 +106,6 @@ struct LocalInfo + bool isVirtualFile = false; + bool isSymLink = false; + bool isMetadataMissing = false; +- bool isPermissionsInvalid = false; + [[nodiscard]] bool isValid() const { return !name.isNull(); } + }; + +diff --git a/src/libsync/filesystem.cpp b/src/libsync/filesystem.cpp +index 9dbdde6..2931a3d 100644 +--- a/src/libsync/filesystem.cpp ++++ b/src/libsync/filesystem.cpp +@@ -468,7 +468,6 @@ bool FileSystem::setFolderPermissions(const QString &path, + case OCC::FileSystem::FolderPermissions::ReadOnly: + break; + case OCC::FileSystem::FolderPermissions::ReadWrite: +- std::filesystem::permissions(stdStrPath, std::filesystem::perms::others_write, std::filesystem::perm_options::remove); + std::filesystem::permissions(stdStrPath, std::filesystem::perms::owner_write, std::filesystem::perm_options::add); + break; + } +diff --git a/src/libsync/owncloudpropagator.cpp b/src/libsync/owncloudpropagator.cpp +index f10fc61..193da94 100644 +--- a/src/libsync/owncloudpropagator.cpp ++++ b/src/libsync/owncloudpropagator.cpp +@@ -1461,9 +1461,15 @@ void PropagateDirectory::slotSubJobsFinished(SyncFileItem::Status status) + try { + if (FileSystem::fileExists(propagator()->fullLocalPath(_item->_file))) { + FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_file), FileSystem::FolderPermissions::ReadOnly); ++ qCDebug(lcDirectory) << "old permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions()); ++ std::filesystem::permissions(propagator()->fullLocalPath(_item->_file).toStdWString(), std::filesystem::perms::owner_write | std::filesystem::perms::group_write | std::filesystem::perms::others_write, std::filesystem::perm_options::remove); ++ qCDebug(lcDirectory) << "new permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions()); + } + if (!_item->_renameTarget.isEmpty() && FileSystem::fileExists(propagator()->fullLocalPath(_item->_renameTarget))) { + FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_renameTarget), FileSystem::FolderPermissions::ReadOnly); ++ qCDebug(lcDirectory) << "old permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions()); ++ std::filesystem::permissions(propagator()->fullLocalPath(_item->_renameTarget).toStdWString(), std::filesystem::perms::owner_write | std::filesystem::perms::group_write | std::filesystem::perms::others_write, std::filesystem::perm_options::remove); ++ qCDebug(lcDirectory) << "new permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions()); + } + } + catch (const std::filesystem::filesystem_error &e) +@@ -1475,13 +1481,15 @@ void PropagateDirectory::slotSubJobsFinished(SyncFileItem::Status status) + } else { + try { + if (FileSystem::fileExists(propagator()->fullLocalPath(_item->_file))) { +- qCDebug(lcDirectory) << propagator()->fullLocalPath(_item->_file) << "old permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions()); + FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_file), FileSystem::FolderPermissions::ReadWrite); +- qCDebug(lcDirectory) << propagator()->fullLocalPath(_item->_file) << "new permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions()); ++ qCDebug(lcDirectory) << "old permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions()); ++ std::filesystem::permissions(propagator()->fullLocalPath(_item->_file).toStdWString(), std::filesystem::perms::owner_write, std::filesystem::perm_options::add); ++ qCDebug(lcDirectory) << "new permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions()); + } + if (!_item->_renameTarget.isEmpty() && FileSystem::fileExists(propagator()->fullLocalPath(_item->_renameTarget))) { +- qCDebug(lcDirectory) << "old permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions()); + FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_renameTarget), FileSystem::FolderPermissions::ReadWrite); ++ qCDebug(lcDirectory) << "old permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions()); ++ std::filesystem::permissions(propagator()->fullLocalPath(_item->_renameTarget).toStdWString(), std::filesystem::perms::owner_write, std::filesystem::perm_options::add); + qCDebug(lcDirectory) << "new permissions" << static_cast(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions()); + } + } +diff --git a/src/libsync/syncengine.cpp b/src/libsync/syncengine.cpp +index c64b921..db23060 100644 +--- a/src/libsync/syncengine.cpp ++++ b/src/libsync/syncengine.cpp +@@ -363,10 +363,6 @@ void OCC::SyncEngine::slotItemDiscovered(const OCC::SyncFileItemPtr &item) + const bool isReadOnly = !item->_remotePerm.isNull() && !item->_remotePerm.hasPermission(RemotePermissions::CanWrite); + modificationHappened = FileSystem::setFileReadOnlyWeak(filePath, isReadOnly); + } +- if (item->isPermissionsInvalid) { +- const auto isReadOnly = !item->_remotePerm.isNull() && !item->_remotePerm.hasPermission(RemotePermissions::CanWrite); +- FileSystem::setFileReadOnly(filePath, isReadOnly); +- } + + modificationHappened |= item->_size != prev._fileSize; + +diff --git a/src/libsync/syncfileitem.h b/src/libsync/syncfileitem.h +index 46ee496..d90348a 100644 +--- a/src/libsync/syncfileitem.h ++++ b/src/libsync/syncfileitem.h +@@ -343,8 +343,6 @@ public: + bool _isLivePhoto = false; + QString _livePhotoFile; + +- bool isPermissionsInvalid = false; +- + QString _discoveryResult; + }; + diff --git a/debian/patches/series b/debian/patches/series index 19fadcd04..b0deb47c4 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -4,3 +4,4 @@ 0004-GIT_SHA1-points-to-the-sha1-of-upstream.patch 0004-Don-t-use-GuiPrivate.patch 0006-Revert-better-logs-and-factor-common-code-in-folder-.patch +0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch