Adjust permissions for deleting spaces

changelog/unreleased/deleteSpacePermissions.md

@@ -0,0 +1,6 @@
+Bugfix: Check permissions when deleting spaces
+
+Do not allow viewers and editors to delete a space (you need to be manager)
+Block deleting a space via dav service (should use graph to avoid accidental deletes)
+
+https://github.com/cs3org/reva/pull/2827

internal/http/services/owncloud/ocdav/delete.go

@@ -154,5 +154,14 @@ func (s *svc) handleSpacesDelete(w http.ResponseWriter, r *http.Request, spaceID
 		return
 	}
 
+	// do not allow deleting spaces via dav endpoint - use graph endpoint instead
+	// we get a relative reference coming from the space root
+	// so if the path is "empty" we a referencing the space
+	if ref.GetPath() == "." {
+		sublog.Info().Msg("deleting spaces via dav is not allowed")
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
 	s.handleDelete(ctx, w, r, ref, sublog)
 }

pkg/storage/utils/decomposedfs/spaces.go

@@ -510,6 +510,11 @@ func (fs *Decomposedfs) DeleteStorageSpace(ctx context.Context, req *provider.De
 		return err
 	}
 
+	// only managers are allowed to disable or purge a drive
+	if err := fs.checkManagerPermission(ctx, n); err != nil {
+		return errtypes.PermissionDenied(fmt.Sprintf("user is not allowed to delete spaces %s", n.ID))
+	}
+
 	if purge {
 		if !n.IsDisabled() {
 			return errtypes.NewErrtypeFromStatus(status.NewInvalidArg(ctx, "can't purge enabled space"))