From 193a3837d9d116ca202c12988f85b6585ee3d7e7 Mon Sep 17 00:00:00 2001
From: Cristian Scheid <cristianscheid@gmail.com>
Date: Thu, 23 Jul 2026 19:46:47 -0300
Subject: [PATCH] fix(share-api-controller): add sanity check on canAccessShare
 for circle share types

Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>
---
 .../lib/Controller/ShareAPIController.php     | 25 +++++++++++++++++--
 build/psalm-baseline.xml                      |  1 +
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/apps/files_sharing/lib/Controller/ShareAPIController.php b/apps/files_sharing/lib/Controller/ShareAPIController.php
index c1edd409c431b..030e751491e02 100644
--- a/apps/files_sharing/lib/Controller/ShareAPIController.php
+++ b/apps/files_sharing/lib/Controller/ShareAPIController.php
@@ -1510,8 +1510,29 @@ protected function canAccessShare(\OCP\Share\IShare $share, bool $checkGroups =
 		}
 
 		if ($share->getShareType() === IShare::TYPE_CIRCLE) {
-			// TODO: have a sanity check like above?
-			return true;
+			if (
+				Server::get(IAppManager::class)->isEnabledForUser('circles')
+				&& class_exists('\OCA\Circles\Api\v1\Circles')
+			) {
+				$hasCircleId = (str_ends_with($share->getSharedWith(), ']'));
+				$shareWithStart = ($hasCircleId ? strrpos($share->getSharedWith(), '[') + 1 : 0);
+				$shareWithLength = ($hasCircleId ? -1 : strpos($share->getSharedWith(), ' '));
+				if ($shareWithLength === false) {
+					$sharedWith = substr($share->getSharedWith(), $shareWithStart);
+				} else {
+					$sharedWith = substr($share->getSharedWith(), $shareWithStart, $shareWithLength);
+				}
+				try {
+					$member = Circles::getMember($sharedWith, $this->userId, 1);
+					if ($member->getLevel() >= 1) {
+						return true;
+					}
+					return false;
+				} catch (\Exception $e) {
+					return false;
+				}
+			}
+			return false;
 		}
 
 		if ($share->getShareType() === IShare::TYPE_ROOM) {
diff --git a/build/psalm-baseline.xml b/build/psalm-baseline.xml
index 8ce1af0776e41..2fb24aa2a5348 100644
--- a/build/psalm-baseline.xml
+++ b/build/psalm-baseline.xml
@@ -886,6 +886,7 @@
     <UndefinedClass>
       <code><![CDATA[\OCA\Circles\Api\v1\Circles]]></code>
       <code><![CDATA[\OCA\Circles\Api\v1\Circles]]></code>
+      <code><![CDATA[\OCA\Circles\Api\v1\Circles]]></code>
     </UndefinedClass>
     <UndefinedDocblockClass>
       <code><![CDATA[$this->getRoomShareHelper()]]></code>