fix version 1

module/base/cloud/internal/logic/share/create_share.go

@@ -35,6 +35,16 @@ func CreateShare(ctx context.Context, in *pb.CreateShareRequest) (reply *pb.Stat
 	}
 
 	// logic code
+	// 校验目标资源确实属于当前用户，禁止对他人资源创建分享
+	owned, err := checkResourceOwner(auth.ID, in.ShareType, uint(in.ResourceId))
+	if err != nil {
+		printer.Error("Check share resource owner error: %v", err)
+		return nil, errcode.ErrDB
+	}
+	if !owned {
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	// 生成分享令牌（如果未提供）
 	shareToken := in.ShareToken
 	if shareToken == "" {
@@ -85,3 +95,49 @@ func CreateShare(ctx context.Context, in *pb.CreateShareRequest) (reply *pb.Stat
 		Timeseq: time.Now().UnixMilli(),
 	}, nil
 }
+
+// checkResourceOwner 校验分享目标资源属于当前用户
+func checkResourceOwner(passportID uint, shareType string, resourceID uint) (bool, error) {
+	var (
+		count int64
+		err   error
+	)
+
+	switch strings.ToLower(strings.TrimSpace(shareType)) {
+	case "file":
+		err = impl.DBService.Model(&models.CloudDiskFile{}).
+			Joins("JOIN cloud_disk_dirs ON cloud_disk_files.directory_id = cloud_disk_dirs.id").
+			Where("cloud_disk_files.id = ? AND cloud_disk_dirs.passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "photo":
+		err = impl.DBService.Model(&models.CloudPhoto{}).
+			Joins("JOIN cloud_albums ON cloud_photos.album_id = cloud_albums.id").
+			Where("cloud_photos.id = ? AND cloud_albums.passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "album":
+		err = impl.DBService.Model(&models.CloudAlbum{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "note":
+		err = impl.DBService.Model(&models.CloudNote{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "bookmark":
+		err = impl.DBService.Model(&models.CloudBookmark{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	case "private":
+		err = impl.DBService.Model(&models.CloudPrivate{}).
+			Where("id = ? AND passport_id = ?", resourceID, passportID).
+			Count(&count).Error
+	default:
+		// 未知的分享类型无法确认资源归属，直接拒绝
+		return false, nil
+	}
+
+	if err != nil {
+		return false, err
+	}
+
+	return count > 0, nil
+}