Merge pull request #7195 from nextcloud/backport/7191/stable28

[stable28] fix: Apply storage checks in addition to share

Author: mejo-

lib/Service/AttachmentService.php

@@ -412,8 +412,9 @@ private function hasUpdatePermissions(string $shareToken): bool {
 					[IShare::TYPE_LINK, IShare::TYPE_EMAIL, IShare::TYPE_ROOM],
 					true
 				)
-				&& $share->getPermissions() & Constants::PERMISSION_UPDATE);
-		} catch (ShareNotFound $e) {
+				&& $share->getPermissions() & Constants::PERMISSION_UPDATE
+				&& $share->getNode()->getPermissions() & Constants::PERMISSION_UPDATE);
+		} catch (ShareNotFound|NotFoundException $e) {
 			return false;
 		}
 	}

lib/Service/DocumentService.php

@@ -603,7 +603,7 @@ public function checkSharePermissions(string $shareToken, int $permission = Cons
 			throw new NotFoundException();
 		}
 
-		if (($share->getPermissions() & $permission) === 0) {
+		if (($share->getPermissions() & $permission) === 0 || ($share->getNode()->getPermissions() & $permission) === 0) {
 			throw new NotFoundException();
 		}
 	}