nextcloud / nextcloud/collectives

[encryption] Page content inaccessible for members without editing permissions

Open
#1,027 38 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop bug feature: server encryption
Dominant language
JavaScript
Stars
195
Forks
51
Avg merge
1d 2h
Merged PRs (30d)
48

Description

description
When creating a collective and sharing it with other users, if the editing rights are not shared with them, they can't see properly the content of the collective pages (but they can still access it and navigate the pages, which are empty).

Steps to reproduce the behavior

  1. Go to 'Collectives'
  2. Create a new collective
  3. Add some pages, with some content in it : text, images, etc
  4. Then go in the collective settings, and restrict the editing to the admins only (or admins and moderators)
  5. Then manage the members and add a user without giving him/her any admin/moderator right
  6. Log in with this user account
  7. Open the collective
  8. You can see the pages titles, but they're all empty
  9. If you come back to the collective admin account and allow the editing for all members, then the dummy user will be able to see everything (except the images that don't appear)

Expected behavior

  • When a collective is shared with others without the editing rights, they should still be able to see the content of every page.
  • And when a collective is shared, images should be propermy displayed.

Screenshots

These are 2 collective pages seen from the collective admin account:

image
image

Same 2 pages but from a user account (with no editing rights) :

image
image

Second page again from the dummy user account but after having changed the editing rights from administrators only to everybody:

image

The settings to limit the edition to administrators only (French version):

image

Server details:

  • Collectives app version: 2.9.1
  • Nextcloud version: 27.1.3.2
  • PHP Version: 8.1.25
  • Database: MariaDB 10.6

Client details:

  • OS: Fedora Linux
  • Browser: Firefox
  • Browser version: 119.0.1 (64 bits)
  • Device: Desktop

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue through Collectives settings with editing restricted, then open the same pages as a member without editing permissions and compare text and image content with the admin view. Done means read-only members can see all page content, including images, while the editing restrictions remain in effect.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, mariadb, php
Domain
authorization, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.