fix: enforce group file upload governance

server/hdl_files.go

@@ -518,9 +518,22 @@ func authorizeUploadTopicLink(tenantID types.TenantID, uid types.Uid, topic stri
 	if !sub.ModeWant.IsReader() || !sub.ModeGiven.IsReader() {
 		return types.ErrPermissionDenied
 	}
+	if types.GetTopicCat(topic) == types.TopicCatGrp {
+		settings, err := store.GroupBusiness.GetSettings(tenantID, topic)
+		if err != nil {
+			return err
+		}
+		if settings != nil && !canUploadGroupFile(settings, sub.ModeGiven) {
+			return types.ErrPermissionDenied
+		}
+	}
 	return nil
 }
 
+func canUploadGroupFile(settings *types.GroupSettings, mode types.AccessMode) bool {
+	return settings == nil || settings.MemberUploadFiles || mode.IsAdmin()
+}
+
 func authorizeLargeFileDownload(tenantID types.TenantID, uid types.Uid, rawURL string, fd *types.FileDef) error {
 	if fd == nil {
 		return types.ErrNotFound