delete public link passwords based on permission

changelog/unreleased/opt-out-public-link-pw.md

@@ -0,0 +1,6 @@
+Enhancement: Opt out of public link password enforcement
+
+Users with special permissions can now delete passwords on read-only public links.
+
+https://github.com/cs3org/reva/pull/4270
+https://github.com/owncloud/ocis/issues/7538

internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go

@@ -469,10 +469,37 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 	newPassword, ok := r.Form["password"]
 	// enforcePassword
 	if h.enforcePassword(permKey) {
-		if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 {
-			response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", err)
+		p, err := conversions.NewPermissions(decreasePermissionsIfNecessary(*permKey))
+		if err != nil {
+			response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check permissions from request", err)
 			return
 		}
+		if !ok && !share.PasswordProtected || ok && len(newPassword[0]) == 0 {
+			// Non-read-only links
+			if p != conversions.PermissionRead {
+				response.WriteOCSError(w, r, response.MetaBadRequest.StatusCode, "missing required password", err)
+				return
+			}
+			// Check if the user is allowed to opt out of the password enforcement
+			// for read-only links
+			resp, err := gwC.CheckPermission(ctx, &permissionsv1beta1.CheckPermissionRequest{
+				SubjectRef: &permissionsv1beta1.SubjectReference{
+					Spec: &permissionsv1beta1.SubjectReference_UserId{
+						UserId: user.Id,
+					},
+				},
+				Permission: "ReadOnlyPublicLinkPassword.Delete",
+			})
+			if err != nil {
+				response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "failed to check user permission", err)
+				return
+			}
+
+			if resp.Status.Code != rpc.Code_CODE_OK {
+				response.WriteOCSError(w, r, response.MetaForbidden.StatusCode, "user is not allowed to delete the password from the public link", nil)
+				return
+			}
+		}
 	}
 
 	// update or clear password