fix: prevent modifications to archived forms in ApiController and ShareApiController

lib/Controller/ApiController.php

@@ -268,6 +268,17 @@
 		]);
 
 		$form = $this->getFormIfAllowed($formId);
+		if (
+			$this->formsService->isFormArchived($form)
+			&& !(
+				sizeof($keyValuePairs) === 1
+				&& key_exists('state', $keyValuePairs)
+				&& $keyValuePairs['state'] === Constants::FORM_STATE_CLOSED
+			)
+		) {
+			$this->logger->debug('This form is archived and can not be modified except to change state to closed.');
+			throw new OCSForbiddenException('This form is archived and can not be modified except to change state to closed.');
+		}
 
 		// Don't allow empty array
 		if (sizeof($keyValuePairs) === 0) {

lib/Controller/ShareApiController.php

@@ -123,6 +123,11 @@
 			throw new OCSNotFoundException('Could not find form');
 		}
 
+		if ($this->formsService->isFormArchived($form)) {
+			$this->logger->debug('This form is archived and can not be modified');
+			throw new OCSForbiddenException('This form is archived and can not be modified');
+		}
+
 		// Check for permission to share form
 		if ($form->getOwnerId() !== $this->currentUser->getUID()) {
 			$this->logger->debug('This form is not owned by the current user');
@@ -243,6 +248,11 @@
 			throw new OCSNotFoundException('Could not find share');
 		}
 
+		if ($this->formsService->isFormArchived($form)) {
+			$this->logger->debug('This form is archived and can not be modified');
+			throw new OCSForbiddenException('This form is archived and can not be modified');
+		}
+
 		if ($formId !== $formShare->getFormId()) {
 			$this->logger->debug('This share doesn\'t belong to the given Form');
 			throw new OCSBadRequestException('Share doesn\'t belong to given Form');
@@ -336,6 +346,11 @@
 			throw new OCSNotFoundException('Could not find share');
 		}
 
+		if ($this->formsService->isFormArchived($form)) {
+			$this->logger->debug('This form is archived and can not be modified');
+			throw new OCSForbiddenException('This form is archived and can not be modified');
+		}
+
 		if ($formId !== $share->getFormId()) {
 			$this->logger->debug('This share doesn\'t belong to the given Form');
 			throw new OCSBadRequestException('Share doesn\'t belong to given Form');