fix: catch OCSForbiddenException in public page search#2346
fix: catch OCSForbiddenException in public page search#2346saschabuehrle wants to merge 1 commit intonextcloud:mainfrom
Conversation
When anonymous users search through a public page share link, checkPageShareAccess() throws OCSForbiddenException instead of NotPermittedException. This change catches both exception types to prevent the API from crashing with HTTP 403 Forbidden. Fixes nextcloud#2345
|
Thanks a lot for your contribution. Makes sense to me. I'll take a close look at the code paths later to properly review it. Workflow results
|
|
Sorry to interrupt, I wanted to let you know that this PR is most probably entirely AI-generated, including replies to your comments. Just see the batch of PRs they opened recently to form your own opinion. |
|
Hello there, We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process. Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6 Thank you for contributing to Nextcloud and we hope to hear from you soon! (If you believe you should not receive this message, you can add yourself to the blocklist.) |
Bug
Issue #2345 — When anonymous users search through a public page share link, the search scans the entire Collective but attempts to filter unauthorized results using checkPageShareAccess(). However, this function throws
OCSForbiddenExceptioninstead of the expectedNotPermittedException, causing the exception to bypass the catch block and crash the API with HTTP 403 Forbidden.Fix
This PR updates the exception handling in the
contentSearchmethod to catch bothNotPermittedExceptionandOCSForbiddenException. This ensures that unauthorized search results are properly filtered out instead of causing the entire API call to fail.Testing
The fix ensures that anonymous users can search through public page shares without encountering HTTP 403 errors when some results are outside their access permissions.
Greetings, saschabuehrle