fix(jsonapi): allow creation of subfolders w/o file area

Closes #6084

Merge request studip/studip!4627

1 files changed, 10 insertions, 5 deletions

diff --git a/lib/classes/JsonApi/Routes/Files/SubfoldersCreate.php b/lib/classes/JsonApi/Routes/Files/SubfoldersCreate.php
index f476f15..1bcf26c 100644
--- a/lib/classes/JsonApi/Routes/Files/SubfoldersCreate.php
+++ b/lib/classes/JsonApi/Routes/Files/SubfoldersCreate.php
@@ -5,7 +5,9 @@ namespace JsonApi\Routes\Files;
 use Psr\Http\Message\ServerRequestInterface as Request;
 use Psr\Http\Message\ResponseInterface as Response;
 use JsonApi\Errors\AuthorizationFailedException;
+use JsonApi\Errors\BadRequestException;
 use JsonApi\Errors\RecordNotFoundException;
+use SimpleORMap;
 
 class SubfoldersCreate extends RangeFoldersCreate
 {
@@ -25,15 +27,18 @@ class SubfoldersCreate extends RangeFoldersCreate
 
     protected function validateAndCreate(Request $request, \Folder $parent)
     {
-        $rangeType = $parent->range_type;
-        $range = $parent->$rangeType;
-
-        if (!Authority::canShowFileArea($user = $this->getUser($request), $range)) {
+        if (!Authority::canShowFolder($user = $this->getUser($request), $parent->getTypedFolder())) {
             throw new AuthorizationFailedException();
         }
 
         $json = $this->validate($request);
 
+        $rangeType = $parent->range_type;
+        if (!is_a($rangeType, SimpleORMap::class, true)) {
+            throw new BadRequestException();
+        }
+        $range = $rangeType::find($parent->range_id);
+
         return $this->validateAndCreateSubfolder($range, $user, $json, $parent);
     }
 
@@ -46,4 +51,4 @@ class SubfoldersCreate extends RangeFoldersCreate
             return $err;
         }
     }
-}
+}
\ No newline at end of file