nextcloud / nextcloud/activity
Deleting a user should anonymize their activities
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 145
- Forks
- 72
- Avg merge
- 6d 9h
- Merged PRs (30d)
- 42
Description
When deleting a user, all its associations needs to be anyonmized according to DSGVO / GDPR
Steps to reproduce
- A group folder is used by user A, B and C
- A creates a file F1 in this group folder
- B creates a file F2 in this group folder
- A changes the file F2
- Admin deletes user A
After step 3: The activity of F1 and F2 includes the user A
After step 4: A is still in the activity log of F1 and F2
Expected behaviour
After the admin deletes user A, F1 and F2 should have a "anonymized" entry so that even the user name of A is not shown.
Actual behaviour
The deleted username does still exist in F1 and F2 activity.
Server configuration
The following setting is configured so that activities of users in group folders are tracked:
activity_use_cached_mountpoints = true
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the user-deletion path and the activity records created for shared group-folder files, using the reproduction steps as the test scenario. Verify the behavior with users A, B, and C and confirm that deleting A removes A’s displayed identity from F1 and F2 while preserving anonymized activity entries.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100