mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-19 18:15:08 +00:00
ignacionelson
51035994ae
Reported by Ricardo Cazati. A client with every file permission could mark their own file public — and was then shown nothing. The screen said "anyone with the link will be able to open and download it" while the only route that makes a link was staff-only, so the link existed for nobody. Version 1 could do this. Making one now asks `upload_public`, the same key that lets them mark the file public, and `update` on the file, which for a client means one they uploaded and nothing else. Staff are not asked for the key, as they never have been: `update` is their boundary and asking now would be a new refusal on every installation that upgrades. Revoking deliberately does not ask for the publishing key. It takes access away, and somebody whose permission to publish was withdrawn must still be able to undo what they published. The portal's file editor grows the section the staff screen has, minus what a client has no business setting: the link, a copy button, and revoke.