add "hide file list" option

[schiessle]

Add a option for public link shares to hide the file list if "can edit" is enabled. This allows to distribute public links to allow people to upload some files without seeing the content of the folder.

fix #4

[LukasReschke]

• Access via /public.php/webdav still works if you use the sharing token as username and an empty password.
• Download of files via download route still works.

Guess we need some further backend changes as well :-)

[juliushaertl]

We should also discuss how to handle file name conflicts.

The currently used file conflict popover is not an option, as it enables any public uploader to override existing files and leaks information about data inside the shared folder. In my oppinion adding a number to the file is sufficient, but this should be enforced by default for file drop.

[jancborchardt]

@juliushaertl good point! An automatic adding of a number in parentheses behind the filename, starting with (2) would be good. cc @schiessle

[MorrisJobke]

Unit tests are failing … 🙈

[schiessle]

Guess we need some further backend changes as well :-)

added a check to the public webdav back-end

[MorrisJobke]

Unit tests are failing:

There was 1 failure:

1) OCA\Files_Sharing\Tests\Controllers\ShareControllerTest::testDownloadShare
OCP\AppFramework\Http\DataResponse Object &0000000005b7e71900000000540b5d39 (
    'data' => 'Share is read-only'
    'headers' => Array &0 (
        'Cache-Control' => 'no-cache, must-revalidate'
        'Content-Security-Policy' => 'default-src 'none';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self';connect-src 'self';media-src 'self''
    )
    'cookies' => Array &0
    'status' => 200
    'lastModified' => null
    'ETag' => null
    'contentSecurityPolicy' => OCP\AppFramework\Http\ContentSecurityPolicy Object &0000000005b7e48800000000540b5d39 (
        'inlineScriptAllowed' => false
        'evalScriptAllowed' => true
        'allowedScriptDomains' => Array &1 (
            0 => ''self''
        )
        'inlineStyleAllowed' => true
        'allowedStyleDomains' => Array &1
        'allowedImageDomains' => Array &1
        'allowedConnectDomains' => Array &1
        'allowedMediaDomains' => Array &1
        'allowedObjectDomains' => Array &1
        'allowedFrameDomains' => Array &1
        'allowedFontDomains' => Array &1
        'allowedChildSrcDomains' => Array &1
    )
) is not instance of expected class "OCP\AppFramework\Http\RedirectResponse".
--- Expected
+++ Actual
@@ @@
-OCP\AppFramework\Http\RedirectResponse Object &0000000005b7e65f00000000540b5d39 (
-    'redirectURL' => 'redirect'
+OCP\AppFramework\Http\DataResponse Object &0000000005b7e71900000000540b5d39 (
+    'data' => 'Share is read-only'
     'headers' => Array &0 (
         'Cache-Control' => 'no-cache, must-revalidate'
-        'Location' => 'redirect'
+        'Content-Security-Policy' => 'default-src 'none';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self';connect-src 'self';media-src 'self''
     )
     'cookies' => Array &0
-    'status' => 303
+    'status' => 200
     'lastModified' => null
     'ETag' => null
-    'contentSecurityPolicy' => null
+    'contentSecurityPolicy' => OCP\AppFramework\Http\ContentSecurityPolicy Object &0000000005b7e48800000000540b5d39 (
+        'inlineScriptAllowed' => false
+        'evalScriptAllowed' => true
+        'allowedScriptDomains' => Array &1 (
+            0 => ''self''
+        )
+        'inlineStyleAllowed' => true
+        'allowedStyleDomains' => Array &1
+        'allowedImageDomains' => Array &1
+        'allowedConnectDomains' => Array &1
+        'allowedMediaDomains' => Array &1
+        'allowedObjectDomains' => Array &1
+        'allowedFrameDomains' => Array &1
+        'allowedFontDomains' => Array &1
+        'allowedChildSrcDomains' => Array &1
+    )
 )

/drone/src/github.com/nextcloud/server/apps/files_sharing/tests/Controllers/ShareControllerTest.php:454

[LukasReschke]

@MorrisJobke Yes. We know 😉

[LukasReschke]

There we go:

… now just the tests 🙈

[LukasReschke]

@nextcloud/designers Check it out! Just create a public shared folder, and mark it as "writable" and then click on the "read only" checkbox. @jancborchardt and @schiessle and me came up with this layout and think it is quite nicely 🎉