nextcloud / nextcloud/android

File preview may leak private information

Open
#17,548 1 comment 0 reactions 0 assignees View on GitHub
approved bug
Dominant language
Kotlin
Stars
5.6k
Forks
2k
Avg merge
2d 18h
Merged PRs (30d)
92

Description

### ⚠️ Before posting ⚠️

- [x] This is a **bug**, not a question or an enhancement.
- [x] I've [searched for similar issues](https://github.com/nextcloud/android/issues) and didn't find a duplicate.
- [x] I've written a clear and descriptive title for this issue, not just "Bug" or "Crash".
- [x] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).

### Steps to reproduce

1. Have some private images in a folder on your Nextcloud account
2. Open the nextcloud app with a friend watching, to show some less private files
3. The friend gets to see a preview of the private images

### Expected behaviour

While it is overkill, implementing #14967 would allow this issue to be avoided by disabling recommendations entirely.
A better solution (but also more work) would be to allow the user to select folders which should be excluded from recommendations.

### Actual behaviour

The app shows the preview for everyone to see.

### Android version

15

### Device brand and model

Fairphone 5

### Stock or custom OS?

Stock

### Nextcloud android app version

34.1.1

### Nextcloud server version

Nextcloud Hub 26 Winter (AIO)

### Using a reverse proxy?

No

### Android logs

_No response_

### Server error logs

```bash

```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with private images and inspect the app's recommendations and file-preview flow; issue #14967 is the related reference. Done should prevent private-folder previews from appearing to others while preserving expected recommendations, with the chosen folder-exclusion behavior documented and tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
mobile, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.