Merge pull request #19773 from nextcloud/backport/19764/stable18

[stable18] Do not allow transfer ownership when the user isn't the owner

Author: rullzer

apps/files/js/dist/personal-settings.js

@@ -96,6 +96,10 @@ public function transfer(string $recipient, string $path): DataResponse {
 			return new DataResponse([], Http::STATUS_BAD_REQUEST);
 		}
 
+		if ($node->getOwner()->getUID() !== $this->userId) {
+			return new DataResponse([], Http::STATUS_FORBIDDEN);
+		}
+
 		$transferOwnership = new TransferOwnershipEntity();
 		$transferOwnership->setSourceUser($this->userId);
 		$transferOwnership->setTargetUser($recipient);

apps/files/js/dist/personal-settings.js.map

@@ -215,7 +215,11 @@ export default {
 				.catch(error => {
 					logger.error('Could not send ownership transfer request', { error })
 
-					this.submitError = error.message || t('files', 'Unknown error')
+					if (error && error.response && error.response.status === 403) {
+						this.submitError = t('files', 'Cannot transfter ownership of a file or folder you don\'t own')
+					} else {
+						this.submitError = error.message || t('files', 'Unknown error')
+					}
 				})
 		},
 	},