Merge pull request #7196 from nextcloud/backport/7191/stable27

[stable27] fix: Apply storage checks in addition to share

Author: mejo-

lib/Service/AttachmentService.php

@@ -411,8 +411,9 @@ private function hasUpdatePermissions(string $shareToken): bool {
 					[IShare::TYPE_LINK, IShare::TYPE_EMAIL, IShare::TYPE_ROOM],
 					true
 				)
-				&& $share->getPermissions() & Constants::PERMISSION_UPDATE);
-		} catch (ShareNotFound $e) {
+				&& $share->getPermissions() & Constants::PERMISSION_UPDATE
+				&& $share->getNode()->getPermissions() & Constants::PERMISSION_UPDATE);
+		} catch (ShareNotFound|NotFoundException $e) {
 			return false;
 		}
 	}

lib/Service/DocumentService.php

@@ -588,7 +588,7 @@ public function checkSharePermissions(string $shareToken, $permission = Constant
 			throw new NotFoundException();
 		}
 
-		if (($share->getPermissions() & $permission) === 0) {
+		if (($share->getPermissions() & $permission) === 0 || ($share->getNode()->getPermissions() & $permission) === 0) {
 			throw new NotFoundException();
 		}
 	}