Merge pull request #7740 from nextcloud/backport/7727/stable31

grnd-alt · web-flow · commit 82ae78b9d2e9 · 2026-03-11T10:11:54.000+01:00
[stable31] fix: check cardId for attachment
diff --git a/lib/Service/AttachmentService.php b/lib/Service/AttachmentService.php
@@ -273,6 +273,7 @@ public function update($cardId, $attachmentId, $data, $type = 'deck_file') {
 		}
 
 		if ($service instanceof ICustomAttachmentService) {
+			$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
 			try {
 				$attachment = new Attachment();
 				$attachment->setId($attachmentId);

Original file line number	Diff line number	Diff line change
`@@ -273,6 +273,7 @@ public function update($cardId, $attachmentId, $data, $type = 'deck_file') {`
`273`	`273`	`}`
`274`	`274`
`275`	`275`	`if ($service instanceof ICustomAttachmentService) {`
	`276`	`+ $this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);`
`276`	`277`	`try {`
`277`	`278`	`$attachment = new Attachment();`
`278`	`279`	`$attachment->setId($attachmentId);`