Merge pull request #19764 from nextcloud/fix/transfer-ownerhip-owner-check

Do not allow transfer ownership when the user isn't the owner

apps/files/lib/Controller/TransferOwnershipController.php

@@ -96,6 +96,10 @@ class TransferOwnershipController extends OCSController {
 			return new DataResponse([], Http::STATUS_BAD_REQUEST);
 		}
 
+		if ($node->getOwner()->getUID() !== $this->userId) {
+			return new DataResponse([], Http::STATUS_FORBIDDEN);
+		}
+
 		$transferOwnership = new TransferOwnershipEntity();
 		$transferOwnership->setSourceUser($this->userId);
 		$transferOwnership->setTargetUser($recipient);

apps/files/src/components/TransferOwnershipDialogue.vue

@@ -215,7 +215,11 @@ export default {
 				.catch(error => {
 					logger.error('Could not send ownership transfer request', { error })
 
-					this.submitError = error.message || t('files', 'Unknown error')
+					if (error?.response?.status === 403) {
+						this.submitError = t('files', 'Cannot transfter ownership of a file or folder you don\'t own')
+					} else {
+						this.submitError = error.message || t('files', 'Unknown error')
+					}
 				})
 		},
 	},