Harden direct editing permission check

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

lib/TokenManager.php

@@ -157,11 +157,22 @@ class TokenManager {
 			// this is required during WopiPutRelativeFile
 			if (is_null($editoruid)) {
 				\OC::$server->getLogger()->warning('Generating token for SaveAs without editoruid');
+				$updatable = true;
 			} else {
 				// Make sure we use the user folder if available since fetching all files by id from the root might be expensive
 				$rootFolder = $this->rootFolder->getUserFolder($editoruid);
-			}
+
+				$updatable = false;
+				$files = $rootFolder->getById($fileId);
+
+				foreach ($files as $file) {
+					if ($file->isUpdateable()) {
 						$updatable = true;
+						break;
+					}
+				}
+			}
+
 		}
 		/** @var File $file */
 		$file = $rootFolder->getById($fileId)[0];