It seems that the rename_internals_fsp() function is allowing a 'rename' to succeed even though the user is explicitly denied write-access to the destination folder by its ACL.

This occurs when the destination folder in the file-system has Unix permissions that allow write-access to the user, example where the permission-bits are 0777.

The result is the the user can rename a file/folder to a destination folder the user is denied access by the ACL, and then the user now loses the ability to access it later.

I was able to verify this by adding a ACL to the destination folder denying me access but I was still able to drag and drop a file into it. 

Looking at the rename_internals_fsp() code, it seems that a call to check_parent_access() should be added for the smb_fname_dst argument before lock and the SMB_VFS_RENAME call is made.

Example fix to rename_internals_fsp (below):

    if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
        status = NT_STATUS_ACCESS_DENIED;
+       goto out;  /* SEEMS TO BE MISSING THE GOTO HERE ??? */
    }

+    uint32_t access_mask = SEC_DIR_ADD_FILE;
+    if (S_ISDIR(smb_fname_dst.st.st_ex_mode)) {
+       access_mask = SEC_DIR_ADD_SUBDIR;
+    }
+    status = check_parent_access(conn,
+                                 smb_fname_dst,
+                                 access_mask);
+    if (!NT_STATUS_IS_OK(status)) {
+        DEBUG(10, ("rename_internals_fsp: "
+               "check_parent_access on "
+               "dst %s returned %s\n",
+               smb_fname_str_dbg(smb_fname_dst),
+               nt_errstr(status) ));
+        goto out;
+    }


    lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);

    /*
     * We have the file open ourselves, so not being able to get the
     * corresponding share mode lock is a fatal error.
     */

    SMB_ASSERT(lck != NULL);


    if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
        uint32 create_options = fsp->fh->private_options;

        DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
              "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
              smb_fname_str_dbg(smb_fname_dst)));