Merge pull request #56668 from nextcloud/fix/noid/real-account-on-deleted-federation

fix(trashbin): deletedBy of a file from a federated folder

Author: ArtificialOwl

apps/files_trashbin/lib/Trashbin.php

@@ -40,12 +40,16 @@
 use OCP\FilesMetadata\IFilesMetadataManager;
 use OCP\IConfig;
 use OCP\IDBConnection;
+use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\IUserManager;
 use OCP\Lock\ILockingProvider;
 use OCP\Lock\LockedException;
 use OCP\Server;
+use OCP\Share\Exceptions\ShareNotFound;
 use OCP\Util;
+use Psr\Container\ContainerExceptionInterface;
+use Psr\Container\NotFoundExceptionInterface;
 use Psr\Log\LoggerInterface;
 
 /** @template-implements IEventListener<BeforeNodeDeletedEvent> */
@@ -326,13 +330,16 @@ public static function move2trash($file_path, $ownerOnly = false) {
 		}
 
 		if ($moveSuccessful) {
+			// there is still a possibility that the file has been deleted by a remote user
+			$deletedBy = self::overwriteDeletedBy($user);
+
 			$query = Server::get(IDBConnection::class)->getQueryBuilder();
 			$query->insert('files_trash')
 				->setValue('id', $query->createNamedParameter($filename))
 				->setValue('timestamp', $query->createNamedParameter($timestamp))
 				->setValue('location', $query->createNamedParameter($location))
 				->setValue('user', $query->createNamedParameter($owner))
-				->setValue('deleted_by', $query->createNamedParameter($user));
+				->setValue('deleted_by', $query->createNamedParameter($deletedBy));
 			$result = $query->executeStatement();
 			if (!$result) {
 				Server::get(LoggerInterface::class)->error('trash bin database couldn\'t be updated', ['app' => 'files_trashbin']);
@@ -1182,6 +1189,29 @@ private static function getNodeForPath(string $user, string $path, string $baseD
 		}
 	}
 
+	/**
+	 * in case the request is authed, and user token is from a federated share
+	 * we use shared_with as initiator of the deletion
+	 */
+	private static function overwriteDeletedBy(string $user) {
+		try {
+			$request = Server::get(IRequest::class);
+			/** @psalm-suppress NoInterfaceProperties */
+			$token = $request->server['PHP_AUTH_USER'] ?? '';
+			if ($token === '') {
+				return $user;
+			}
+
+			$federatedShareProvider = Server::get(\OCA\FederatedFileSharing\FederatedShareProvider::class);
+			$share = $federatedShareProvider->getShareByToken($token);
+
+			return $share->getSharedWith();
+		} catch (NotFoundExceptionInterface|ContainerExceptionInterface|ShareNotFound) {
+		}
+
+		return $user;
+	}
+
 	public function handle(Event $event): void {
 		if ($event instanceof BeforeNodeDeletedEvent) {
 			self::ensureFileScannedHook($event->getNode());