nextcloud / nextcloud/files_accesscontrol

OCA\DAV\Connector\Sabre\Exception\Forbidden: No read permissions - Incompatible with "Terms of service"?

Open
#204 10 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
PHP
Stars
60
Forks
22
Avg merge
2d 11h
Merged PRs (30d)
34

Description

Steps to reproduce
  1. install terms of service
  2. create public share
  3. access the share as a "guest"
Expected behaviour

The function of the app is not affected, but generates an error

Actual behaviour

Do not generate error

Server configuration detail

Operating system: Linux 4.19.0-13-amd64 nextcloud/server#1 SMP Debian 4.19.160-2 (2020-11-28) x86_64

Webserver: nginx/1.18.0 (fpm-fcgi)

Database: MariaDB/mysql 10.5.8

PHP version:

7.4.13
Modules loaded: Core, date, libxml, openssl, pcre, zlib, bz2, calendar, ctype, hash, filter, ftp, gettext, gmp, SPL, iconv, Reflection, session, standard, SimpleXML, sockets, mbstring, tokenizer, xml, cgi-fcgi, mysqlnd, bcmath, curl, dba, dom, enchant, fileinfo, gd, imagick, imap, intl, json, ldap, exif, mysqli, odbc, PDO, pdo_mysql, PDO_ODBC, pdo_pgsql, pdo_sqlite, pgsql, Phar, posix, pspell, redis, soap, sodium, sqlite3, sysvmsg, sysvsem, sysvshm, tidy, xmlreader, xmlrpc, xmlwriter, xsl, zip, ionCube Loader, Zend OPcache

Nextcloud version: 20.0.4 - 20.0.4.0

Updated from an older Nextcloud/ownCloud or fresh install: Update from 20.0.3

Where did you install Nextcloud from: download.nextcloud.com

Signing status

Array
(
)

List of activated apps 
Enabled:
 - accessibility: 1.6.0
 - activity: 2.13.4
 - admin_audit: 1.10.0
 - bruteforcesettings: 2.0.1
 - calendar: 2.1.2
 - cloud_federation_api: 1.3.0
 - comments: 1.10.0
 - contacts: 3.4.2
 - contactsinteraction: 1.1.0
 - cookbook: 0.7.7
 - dashboard: 7.0.0
 - dav: 1.16.2
 - federatedfilesharing: 1.10.2
 - federation: 1.10.1
 - files: 1.15.0
 - files_pdfviewer: 2.0.1
 - files_readmemd: 1.2.0
 - files_rightclick: 0.17.0
 - files_sharing: 1.12.1
 - files_trashbin: 1.10.1
 - files_versions: 1.13.0
 - files_videoplayer: 1.9.0
 - groupfolders: 8.2.0
 - integration_github: 0.0.14
 - issuetemplate: 0.7.0
 - logreader: 2.5.0
 - lookup_server_connector: 1.8.0
 - mail: 1.7.2
 - nextcloud_announcements: 1.9.0
 - notifications: 2.8.0
 - oauth2: 1.8.0
 - ocdownloader: 1.7.9
 - password_policy: 1.10.1
 - photos: 1.2.1
 - privacy: 1.4.0
 - provisioning_api: 1.10.0
 - recommendations: 0.8.0
 - serverinfo: 1.10.0
 - settings: 1.2.0
 - sharebymail: 1.10.0
 - side_menu: 1.21.0
 - support: 1.3.0
 - survey_client: 1.8.0
 - systemtags: 1.10.0
 - terms_of_service: 1.6.1
 - text: 3.1.0
 - theming: 1.11.0
 - theming_customcss: 1.7.0
 - twofactor_backupcodes: 1.9.0
 - twofactor_totp: 5.0.0
 - twofactor_u2f: 6.0.0
 - updatenotification: 1.10.0
 - user_status: 1.0.1
 - viewer: 1.4.0
 - weather_status: 1.0.0
 - workflowengine: 2.2.0
Disabled:
 - encryption
 - files_external
 - firstrunwizard
 - occweb
 - user_ldap
Configuration (config/config.php) 
{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "cloud.domain.tld"
    ],
    "memcache.distributed": "\\OC\\Memcache\\Redis",
    "memcache.local": "\\OC\\Memcache\\Redis",
    "memcache.locking": "\\OC\\Memcache\\Redis",
    "redis": {
        "host": "***REMOVED SENSITIVE VALUE***",
        "port": 6379
    },
    "log_type": "file",
    "logtimezone": "Europe\/Berlin",
    "logfile": "\/var\/www\/vhosts\/domain.tld\/logs\/cloud.domain.tld\/nextcloud.log",
    "loglevel": 2,
    "syslog_tag": "Nextcloud",
    "simpleSignUpLink.shown": false,
    "maintenance": false,
    "share_folder": "\/Mit mir geteilt",
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "dbtype": "mysql",
    "version": "20.0.4.0",
    "overwrite.cli.url": "https:\/\/cloud.domain.tld",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "mail_smtpmode": "smtp",
    "mail_smtpsecure": "ssl",
    "mail_sendmailmode": "smtp",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpauthtype": "LOGIN",
    "mail_smtpauth": 1,
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "465",
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "app_install_overwrite": [
        "files_readmemd",
        "occweb",
        "ocdownloader",
        "cookbook"
    ],
    "twofactor_enforced": "true",
    "twofactor_enforced_groups": [
        "admin"
    ],
    "twofactor_enforced_excluded_groups": [],
    "theme": "",
    "updater.release.channel": "stable"
}

Are you using external storage, if yes which one: no

Are you using encryption:

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36

Operating system: Windows 10, IpadOS 14, iOS 14

Logs

Web server error log 
No errors listed
Nextcloud log 
{"reqId":"JTx5zfGlole328dmzp2E","level":4,"time":"2020-12-21T11:23:23+01:00","remoteAddr":"91.221.58.28","user":"--","app":"webdav","method":"PROPFIND","url":"/public.php/webdav/","message":{"Exception":"OCA\\DAV\\Connector\\Sabre\\Exception\\Forbidden","Message":"No read permissions","Code":0,"Trace":[{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Tree.php","line":204,"function":"getChildren","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Server.php","line":905,"function":"getChildren","class":"Sabre\\DAV\\Tree","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Server.php","line":987,"function":"generatePathNodes","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Server.php","line":1678,"function":"getPropertiesIteratorForPath","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Server.php","line":1661,"function":"writeMultiStatus","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":363,"function":"generateMultiStatus","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPropFind","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Server.php","line":474,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Server.php","line":251,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/3rdparty/sabre/dav/lib/DAV/Server.php","line":319,"function":"start","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/apps/dav/appinfo/v1/publicwebdav.php","line":113,"function":"exec","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/vhosts/domain.tld/cloud.domain.tld/public.php","line":81,"args":["/var/www/vhosts/domain.tld/cloud.domain.tld/apps/dav/appinfo/v1/publicwebdav.php"],"function":"require_once"}],"File":"/var/www/vhosts/domain.tld/cloud.domain.tld/apps/dav/lib/Connector/Sabre/Directory.php","Line":262,"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36","version":"20.0.4.0","id":"5fe0783163102"}
Browser log

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the interaction between the Terms of Service app and a guest accessing a public share, using the logged PROPFIND request as the starting point. Inspect apps/dav/lib/Connector/Sabre/Directory.php around line 262 and the public WebDAV entry point in apps/dav/appinfo/v1/publicwebdav.php; first clarify whether the Forbidden error is expected, then verify the agreed behavior without an erroneous error log.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.