nextcloud / nextcloud/collectives
People can end up in pre-existing teams and pre-existig teams can get access to collectives unintentionally
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 195
- Forks
- 51
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 48
Description
-
First of all: By default, Collectives creates a team with the same name as the collective.
-
In the following test, I created a team called “TeamHuhu” with admin + test1 as members.
-
Then I created a collective called “TeamHuhu”: Although a team with the same name already exists (!), Collectives gives the impression that you still have to select members:
- However, if I go directly to “Create without members” in the screen, the existing ‘TeamHuhu’ is used, and “test1” has direct access, even though I had not selected the user in the screen before:
- When I add members during collective creation. These then end up in the pre-existing team, which means that they have than access to all other team resources as well
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by reproducing the collective-creation flow with an existing same-name team, then trace how team selection and member assignment are handled. Done means existing team members do not gain unintended collective access and newly selected members do not receive access to unrelated resources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100