Security and Permissions
Relevant source files
The following files were used as context for generating this wiki page:
The Nextcloud CAD Viewer is designed as a native integration that inherits and enforces Nextcloud's core security principles. The application operates primarily as a browser-based viewer, meaning CAD data is processed on the client side, while the backend ensures that only authorized users can access specific file metadata and content.
Access control is managed through the standard Nextcloud filesystem permissions, ensuring that files shared via links or internal groups maintain their intended restriction levels. The app uses the OCA\CadViewer\Controller\FileController to mediate all requests for CAD data, validating user sessions and file readability before any data is streamed to the client.
Sources: README.md:16-17, lib/Controller/FileController.php:48-51, wiki/User-Guide.md:33-40
User Authentication and Authorization
All API endpoints within the CAD Viewer application require a valid user session. The backend controller utilizes OCP\IUserSession to identify the requesting user and ensure they are authenticated within the Nextcloud instance.
File Access Validation
When a user attempts to view a file, the system performs a multi-step validation:
- Session Check: Verifies the user is logged in.
- Ownership/Sharing Check: Uses
IRootFolderto retrieve the file from the user's specific folder context. - Permission Check: Explicitly calls
$file->isReadable()to ensure the user has the necessary permissions to view the file.
Sources: lib/Controller/FileController.php:60-75, lib/Controller/FileController.php:111-125
Request Flow for Secure File Loading
The following diagram illustrates how the application validates permissions before delivering CAD content.
API Security Attributes
The application's controllers utilize PHP attributes to define security exemptions and requirements. In the case of the CAD Viewer, specific endpoints are marked to allow access without administrative rights, provided the standard user permissions are met.
| Attribute | Purpose | Relevant Methods |
|---|---|---|
#[NoAdminRequired] | Allows regular users to access the endpoint without admin privileges. | getFile, getFileContent, preview |
#[NoCSRFRequired] | Disables Cross-Site Request Forgery checks for specific streaming/metadata actions. | getFile, getFileContent, preview |
Sources: lib/Controller/FileController.php:57-58, lib/Controller/FileController.php:104-105, lib/Controller/FileController.php:147-148
Client-Side Security
The CAD Viewer leverages WebGL for browser-based rendering, which reduces the server-side attack surface as the server does not need to execute CAD parsing binaries.
Supported MIME Types Enforcement
To prevent unauthorized file types from being processed through the CAD API, the FileController enforces a strict whitelist of supported CAD MIME types. If a file's MIME type does not match this list, the request is rejected with a 415 Unsupported Media Type or STATUS_FORBIDDEN error.
private const SUPPORTED_MIME_TYPES = [
'application/acad',
'application/autocad_dwg',
'application/dwg',
'application/x-autocad',
'application/x-dwg',
'image/vnd.dwg',
'image/vnd.dxf',
'application/dxf',
'application/x-dxf',
'image/x-dxf',
];
Sources: lib/Controller/FileController.php:28-39, lib/Controller/FileController.php:77-80
Shared Link Security
Files shared via Nextcloud public links are also protected. The application architecture ensures that:
- Read-Only Access: By default, viewers are read-only unless the share permission explicitly allows editing (though the current implementation is focused on viewing).
- Link Permissions: The viewer respect the "Download" restriction on shared links. If a user is not permitted to download or read the file via the share settings, the
isReadable()check will fail on the backend.
Sources: wiki/User-Guide.md:38-40, README.md:16-17
Conclusion
Security and permissions in the Nextcloud CAD Viewer are deeply integrated with the host environment's existing Access Control Lists (ACLs). By leveraging Nextcloud's OCP (Object Control Panels) and IRootFolder APIs, the application ensures that data leakage is prevented through server-side validation of ownership, session validity, and file readability before any CAD data is transmitted for client-side rendering.