fix: disable direct link if link shares are disabled

Signed-off-by: Robin Appelman <robin@icewind.nl>

apps/dav/lib/Controller/DirectController.php

@@ -26,6 +26,7 @@ use OCP\Files\IRootFolder;
 use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\Security\ISecureRandom;
+use OCP\Share\IManager;
 
 class DirectController extends OCSController {
 
@@ -39,6 +40,7 @@ class DirectController extends OCSController {
 		private ITimeFactory $timeFactory,
 		private IURLGenerator $urlGenerator,
 		private IEventDispatcher $eventDispatcher,
+		private IManager $shareManager,
 	) {
 		parent::__construct($appName, $request);
 	}
@@ -57,6 +59,10 @@ class DirectController extends OCSController {
 	 */
 	#[NoAdminRequired]
 	public function getUrl(int $fileId, int $expirationTime = 60 * 60 * 8): DataResponse {
+		if (!$this->shareManager->shareApiAllowLinks()) {
+			throw new OCSForbiddenException('Creating direct links is disabled');
+		}
+
 		$userFolder = $this->rootFolder->getUserFolder($this->userId);
 
 		$file = $userFolder->getFirstNodeById($fileId);

apps/dav/tests/unit/Controller/DirectControllerTest.php

@@ -14,6 +14,7 @@ use OCA\DAV\Db\Direct;
 use OCA\DAV\Db\DirectMapper;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCS\OCSBadRequestException;
+use OCP\AppFramework\OCS\OCSForbiddenException;
 use OCP\AppFramework\OCS\OCSNotFoundException;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\EventDispatcher\IEventDispatcher;
@@ -23,6 +24,7 @@ use OCP\Files\IRootFolder;
 use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\Security\ISecureRandom;
+use OCP\Share\IManager;
 use PHPUnit\Framework\MockObject\MockObject;
 use Test\TestCase;
 
@@ -33,6 +35,7 @@ class DirectControllerTest extends TestCase {
 	private ITimeFactory&MockObject $timeFactory;
 	private IURLGenerator&MockObject $urlGenerator;
 	private IEventDispatcher&MockObject $eventDispatcher;
+	private IManager&MockObject $shareManager;
 
 	private DirectController $controller;
 
@@ -45,6 +48,7 @@ class DirectControllerTest extends TestCase {
 		$this->timeFactory = $this->createMock(ITimeFactory::class);
 		$this->urlGenerator = $this->createMock(IURLGenerator::class);
 		$this->eventDispatcher = $this->createMock(IEventDispatcher::class);
+		$this->shareManager = $this->createMock(IManager::class);
 
 		$this->controller = new DirectController(
 			'dav',
@@ -55,11 +59,15 @@ class DirectControllerTest extends TestCase {
 			$this->random,
 			$this->timeFactory,
 			$this->urlGenerator,
-			$this->eventDispatcher
+			$this->eventDispatcher,
+			$this->shareManager,
 		);
 	}
 
 	public function testGetUrlNonExistingFileId(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(true);
+
 		$userFolder = $this->createMock(Folder::class);
 		$this->rootFolder->method('getUserFolder')
 			->with('awesomeUser')
@@ -74,6 +82,9 @@ class DirectControllerTest extends TestCase {
 	}
 
 	public function testGetUrlForFolder(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(true);
+
 		$userFolder = $this->createMock(Folder::class);
 		$this->rootFolder->method('getUserFolder')
 			->with('awesomeUser')
@@ -90,6 +101,9 @@ class DirectControllerTest extends TestCase {
 	}
 
 	public function testGetUrlValid(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(true);
+
 		$userFolder = $this->createMock(Folder::class);
 		$this->rootFolder->method('getUserFolder')
 			->with('awesomeUser')
@@ -136,4 +150,23 @@ class DirectControllerTest extends TestCase {
 			'url' => 'https://my.nextcloud/remote.php/direct/superduperlongtoken',
 		], $result->getData());
 	}
+
+	public function testGetUrlNoLinkShares(): void {
+		$this->shareManager->method('shareApiAllowLinks')
+			->willReturn(false);
+
+		$userFolder = $this->createMock(Folder::class);
+		$this->rootFolder->method('getUserFolder')
+			->with('awesomeUser')
+			->willReturn($userFolder);
+
+		$file = $this->createMock(File::class);
+
+		$userFolder->method('getFirstNodeById')
+			->with(101)
+			->willReturn($file);
+
+		$this->expectException(OCSForbiddenException::class);
+		$this->controller->getUrl(101);
+	}
 }