nextcloud / nextcloud/android

Security Risk: auto downloading file to device and Google's built in file explorer or any file explorer

Open
#223 11 comments 0 reactions 0 assignees View on GitHub
enhancement hotspot: device storage security
Dominant language
Kotlin
Stars
5.6k
Forks
2k
Avg merge
2d 18h
Merged PRs (30d)
92

Description

### Actual behaviour

My Nextcloud application is setup to require a password on start before accessing any data, but when I click on a file, the application is caching the file to the device permanently despite not checking "make this file available offline" in the settings menu. The cached data can then be accessed without a password through Google's integrated file browser found in Settings>Storage>Explore. Android will not allow viewing of the file because it's not within the Nextcloud app, but I can email or text the file to anyone and it can be opened like any other file.
### Desired behaviour

The Nextcloud application should have a global setting, "Cache data locally", with each file having their own setting, "make available offline".
1. If the global setting is disabled, any data downloaded via the Nextcloud application should be stored in RAM ONLY and purged once the application is closed. This global setting, if enabled, would also permanently disallow individual file, "make available offline".
2. If the global setting is enabled, any data downloaded via the Nextcloud application should be stored locally on the device, as it is now, but purged once the application is closed unless the user sets "make available offline" and then ONLY those files are retained on the device.
### Steps to reproduce
1. Open Nextcloud
2. Set password required
3. Click on a file: document, picture, video, whatever
4. Open Settings>Storage>Explore
5. Navigate to the Nextcloud folder and find the file previously accessed file
6. Push and hold on the file and select to share
7. E-mail the file to yourself
8. View the file
### Environment data

Android version: 7.0 nougat (NRD90M)

Device model: Nexus 6P

Stock or customized system: Stock Google Android ROM (NRD90M)

Nextcloud app version:1.2.0

Nextcloud server version: 9.0.53

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.