From fc1552c0285c1e78fb83fbba7ea58ccb7a861a01 Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Wed, 4 Oct 2023 17:18:34 +0200
Subject: [PATCH] Improve error messages about passwords for viewers #1269

---
 www/common/common-ui-elements.js  | 23 ++++++++++++++++++-----
 www/common/sframe-common-outer.js | 23 +++++++++++++++++------
 www/common/sframe-common.js       |  9 ++++++++-
 3 files changed, 43 insertions(+), 12 deletions(-)

diff --git a/www/common/common-ui-elements.js b/www/common/common-ui-elements.js
index 01e5d275b..3a03807f2 100644
--- a/www/common/common-ui-elements.js
+++ b/www/common/common-ui-elements.js
@@ -2865,6 +2865,7 @@ define([
     UIElements.onServerError = function (common, err, toolbar, cb) {
         //if (["EDELETED", "EEXPIRED", "ERESTRICTED"].indexOf(err.type) === -1) { return; }
         var priv = common.getMetadataMgr().getPrivateData();
+        var viewer = priv.readOnly || err.viewer;
         var sframeChan = common.getSframeChannel();
         var msg = err.type;
         var exitable = Boolean(err.loaded);
@@ -2894,7 +2895,8 @@ define([
                     return common.setLoginRedirect('');
                 });
             }
-            if (err.message && err.message !== "PASSWORD_CHANGE") {
+            if (err.message && (err.message !== "PASSWORD_CHANGE" || viewer)) {
+                // XXX If readonly, tell the viewer that their link won't work with the new password
                 UI.errorLoadingScreen(UI.getDestroyedPlaceholder(err.message, false),
                     exitable, exitable);
                 return;
@@ -2908,7 +2910,7 @@ define([
 
             // View users have the wrong seed, thay can't retireve access directly
             // Version 1 hashes don't support passwords
-            if (!priv.readOnly && !priv.oldVersionHash) {
+            if (!viewer && !priv.oldVersionHash) {
                 sframeChan.event('EV_SHARE_OPEN', {hidden: true}); // Close share modal
                 UIElements.displayPasswordPrompt(common, {
                     fromServerError: true,
@@ -2943,7 +2945,10 @@ define([
 
     UIElements.displayPasswordPrompt = function (common, cfg, isError) {
         var error;
-        if (isError) { error = setHTML(h('p.cp-password-error'), Messages.password_error); }
+        if (isError) {
+            let msg = isError === 'PASSWORD_CHANGE' ? Messages.drive_sfPasswordError : Messages.password_error;
+            error = setHTML(h('p.cp-password-error'), msg);
+        }
 
         var pwMsg = UI.getDestroyedPlaceholderMessage('PASSWORD_CHANGE', false);
         if (cfg.legacy) {
@@ -2987,8 +2992,16 @@ define([
                 });
             }
             common.getSframeChannel().query('Q_PAD_PASSWORD_VALUE', value, function (err, data) {
-                if (!data) {
-                    return void UIElements.displayPasswordPrompt(common, cfg, true);
+                data = data || {};
+                if (!data.state && data.view && data.reason === "PASSWORD_CHANGE") {
+                    return UIElements.onServerError(common, {
+                        type: 'EDELETED',
+                        message: data.reason,
+                        viewer: data.view
+                    });
+                }
+                if (!data.state) {
+                    return void UIElements.displayPasswordPrompt(common, cfg, (data && data.reason) || 1);
                 }
             });
         };
diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js
index d41f7f99c..a24cbe290 100644
--- a/www/common/sframe-common-outer.js
+++ b/www/common/sframe-common-outer.js
@@ -432,6 +432,8 @@ define([
                     return void todo();
                 }
 
+                var isViewer = parsed.hashData.mode === 'view';
+
                 // We now need to check if there is a password and if we know the correct password.
                 // We'll use getFileSize and hasChannelHistory to detect incorrect passwords.
 
@@ -459,7 +461,11 @@ define([
                             if (Boolean(isNew)) {
                                 // Ask again in the inner iframe
                                 // We should receive a new Q_PAD_PASSWORD_VALUE
-                                cb(false);
+                                cb({
+                                    state: false,
+                                    view: isViewer,
+                                    reason: e
+                                });
                             } else {
                                 todo();
                                 if (wrongPasswordStored) {
@@ -477,7 +483,9 @@ define([
                                 } else {
                                     correctPassword();
                                 }
-                                cb(true);
+                                cb({
+                                    state: true
+                                });
                             }
                         };
                         if (parsed.type === "file") {
@@ -496,7 +504,7 @@ define([
                             if (isNew && reason && reason !== "PASSWORD_CHANGE") {
                                 return sframeChan.event("EV_DELETED_ERROR", reason);
                             }
-                            next();
+                            next(reason, isNew);
                         });
                     });
                     sframeChan.event("EV_PAD_PASSWORD", cfg);
@@ -608,12 +616,15 @@ define([
                         }
                         if (!e && !isNew) { return void todo(); }
                         // NOTE: Legacy mode ==> no reason may indicate a password change
-                        if (isNew && reason && reason !== "PASSWORD_CHANGE") {
-                            sframeChan.event("EV_DELETED_ERROR", reason);
+                        if (isNew && reason && (reason !== "PASSWORD_CHANGE" || isViewer)) {
+                            sframeChan.event("EV_DELETED_ERROR", {
+                                reason: reason,
+                                viewer: isViewer
+                            });
                             waitFor.abort();
                             return;
                         }
-                        if (parsed.hashData.mode === 'view' && (password || !parsed.hashData.password)) {
+                        if (isViewer && (password || !parsed.hashData.password)) {
                             // Error, wrong password stored, the view seed has changed with the password
                             // password will never work
                             sframeChan.event("EV_PAD_PASSWORD_ERROR");
diff --git a/www/common/sframe-common.js b/www/common/sframe-common.js
index e8c7f7d84..8f56cb242 100644
--- a/www/common/sframe-common.js
+++ b/www/common/sframe-common.js
@@ -849,9 +849,16 @@ define([
             });
 
             ctx.sframeChan.on("EV_DELETED_ERROR", function (reason) {
+                var obj = reason;
+                var viewer;
+                if (typeof(reason) === "object") {
+                    reason = obj.reason;
+                    viewer = obj.viewer;
+                }
                 funcs.onServerError({
                     type: 'EDELETED',
-                    message: reason
+                    message: reason,
+                    viewer: viewer
                 });
             });