From d5e281f1b8a7f8239cba81df6e489a9c39550727 Mon Sep 17 00:00:00 2001
From: Cristian Scheid <cristianscheid@gmail.com>
Date: Thu, 23 Jul 2026 19:46:47 -0300
Subject: [PATCH] fix(share-api-controller): add sanity check on canAccessShare
 for circle share types

Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>
---
 .../lib/Controller/ShareAPIController.php     | 25 +++++++++++++++++--
 build/psalm-baseline.xml                      |  1 +
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/apps/files_sharing/lib/Controller/ShareAPIController.php b/apps/files_sharing/lib/Controller/ShareAPIController.php
index 1c82c46f9fb82..c3f5d0acc0278 100644
--- a/apps/files_sharing/lib/Controller/ShareAPIController.php
+++ b/apps/files_sharing/lib/Controller/ShareAPIController.php
@@ -1533,8 +1533,29 @@ protected function canAccessShare(IShare $share, bool $checkGroups = true): bool
 		}
 
 		if ($share->getShareType() === IShare::TYPE_CIRCLE) {
-			// TODO: have a sanity check like above?
-			return true;
+			if (
+				Server::get(IAppManager::class)->isEnabledForUser('circles')
+				&& class_exists('\OCA\Circles\Api\v1\Circles')
+			) {
+				$hasCircleId = (str_ends_with($share->getSharedWith(), ']'));
+				$shareWithStart = ($hasCircleId ? strrpos($share->getSharedWith(), '[') + 1 : 0);
+				$shareWithLength = ($hasCircleId ? -1 : strpos($share->getSharedWith(), ' '));
+				if ($shareWithLength === false) {
+					$sharedWith = substr($share->getSharedWith(), $shareWithStart);
+				} else {
+					$sharedWith = substr($share->getSharedWith(), $shareWithStart, $shareWithLength);
+				}
+				try {
+					$member = Circles::getMember($sharedWith, $this->userId, 1);
+					if ($member->getLevel() >= 1) {
+						return true;
+					}
+					return false;
+				} catch (\Exception $e) {
+					return false;
+				}
+			}
+			return false;
 		}
 
 		if ($share->getShareType() === IShare::TYPE_ROOM) {
diff --git a/build/psalm-baseline.xml b/build/psalm-baseline.xml
index ad09464c36626..bc1dfda9aca42 100644
--- a/build/psalm-baseline.xml
+++ b/build/psalm-baseline.xml
@@ -1680,6 +1680,7 @@
     <UndefinedClass>
       <code><![CDATA[Circles]]></code>
       <code><![CDATA[Circles]]></code>
+      <code><![CDATA[Circles]]></code>
     </UndefinedClass>
   </file>
   <file src="apps/files_sharing/lib/Controller/ShareController.php">