nextcloud / nextcloud/files_lock
Read-only recipient can lock a shared file to prevent the owner from modifying their own file
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 39
- Forks
- 10
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 48
Description
How to use GitHub
- Please use the 👍 reaction to show that you are affected by the same issue.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Steps to reproduce
- User A creates a file in their personal space (not a Group folder, not external storage).
- User A shares that single file with user B with view-only permission (no edit, no upload, no delete).
- User B opens the file in Files app and clicks Lock in the file sidebar (Files Lock app enabled).
- Now the file is locked by B.
- User A (the owner of the file) opens the same file’s sidebar and tries to Unlock.
Expected behaviour
A user with view-only permission must not be able to lock the file and the owner of the file must always be able to unlock any lock on their own file (even if it was locked by someone else).
Actual behaviour
- User B (view-only) can lock the file successfully.
- User A (owner) cannot unlock from the UI (unlock button missing/disabled or results in an error).
- The only way to remove the lock is for an admin to run occ files:lock --unlock.
- This effectively lets a read-only recipient “lock out” the actual owner of the file.
Server configuration
Web server: Docker
Database: PostgreSQL
PHP version: 8.3
Nextcloud version: Nextcloud Hub 25 Autumn (32.0.1)
List of activated apps
Enabled:
- activity: 5.0.0-dev.0
- admin_audit: 1.22.0
- app_api: 32.0.0
- bruteforcesettings: 5.0.0-dev.0
- circles: 32.0.0
- cloud_federation_api: 1.16.0
- comments: 1.22.0
- contactsinteraction: 1.13.1
- dashboard: 7.12.0
- dav: 1.34.2
- federatedfilesharing: 1.22.0
- federation: 1.22.0
- files: 2.4.0
- files_accesscontrol: 3.0.1
- files_automatedtagging: 3.0.0
- files_downloadlimit: 5.0.0-dev.0
- files_lock: 32.0.0
- files_pdfviewer: 5.0.0-dev.0
- files_reminders: 1.5.0
- files_sharing: 1.24.0
- files_trashbin: 1.22.0
- files_versions: 1.25.0
- firstrunwizard: 5.0.0-dev.0
- group_default_quota: 0.1.12
- groupfolders: 20.1.3
- groupquota: 0.2.3
- logreader: 5.0.0-dev.0
- lookup_server_connector: 1.20.0
- nextcloud_announcements: 4.0.0-dev.0
- notifications: 5.0.0-dev.0
- oauth2: 1.20.0
- oidc_login: 3.2.2
- onlyoffice: 9.11.0
- password_policy: 4.0.0-dev.0
- photos: 5.0.0-dev.1
- privacy: 4.0.0-dev.0
- profile: 1.1.0
- provisioning_api: 1.22.0
- quota_warning: 1.22.0
- recommendations: 5.0.0-dev.0
- related_resources: 3.0.0-dev.0
- serverinfo: 4.0.0-dev.0
- settings: 1.15.1
- sharebymail: 1.22.0
- support: 4.0.0-dev.0
- survey_client: 4.0.0-dev.0
- systemtags: 1.22.0
- text: 6.0.1
- theming: 2.7.0
- theming_customcss: 1.19.0
- twofactor_backupcodes: 1.21.0
- twofactor_totp: 14.0.0
- updatenotification: 1.22.0
- user_ldap: 1.23.0
- user_status: 1.12.0
- viewer: 5.0.0-dev.0
- weather_status: 1.12.0
- webhook_listeners: 1.3.0
- workflowengine: 2.14.0
Disabled: - encryption: 2.20.0
- files_external: 1.24.0
- richdocuments: 9.0.1 (installed 9.0.1)
- suspicious_login: 10.0.0-dev.0
- twofactor_nextcloud_notification: 6.0.0-dev.0
- user_saml: 7.0.0 (installed 7.0.0)
Nextcloud configuration
{
"system": {
"htaccess.RewriteBase": "/",
"memcache.local": "\OC\Memcache\APCu",
"apps_paths": [
{
"path": "/var/www/html/apps",
"url": "/apps",
"writable": false
},
{
"path": "/var/www/html/custom_apps",
"url": "/custom_apps",
"writable": true
}
],
"upgrade.disable-web": true,
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
REMOVED SENSITIVE VALUE
],
"datadirectory": "REMOVED SENSITIVE VALUE",
"dbtype": "pgsql",
"version": "32.0.1.2",
"overwrite.cli.url": "REMOVED SENSITIVE VALUE",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbtableprefix": "oc_",
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true,
"instanceid": "REMOVED SENSITIVE VALUE",
"app_install_overwrite": [
"gluusso",
"oidc_login"
],
"oidc_login_provider_url": "REMOVED SENSITIVE VALUE",
"oidc_login": {
"client_secret": "REMOVED SENSITIVE VALUE",
"login_scopes": "openid profile email groups",
"client_id": "nextcloud"
},
"oidc_login_client_id": "nextcloud",
"oidc_login_login_scopes": "openid profile email groups",
"oidc_login_client_secret": "REMOVED SENSITIVE VALUE",
"oidc_login_auto_create_users": "true",
"oidc_login_disable_registration": false,
"oidc_login_logout_url": "REMOVED SENSITIVE VALUE",
"oidc_login_end_session_redirect": true,
"defaultapp": "dashboard",
"ldapProviderFactory": "REMOVED SENSITIVE VALUE"
}
}
Browser
Browser name: Chrome
Browser version: Version 133.0.6943.54 (Official Build) (64-bit)
Operating system: Windows
Browser log
No JS errors related to locking; UI shows file as locked by user B.
If needed I can attach a network/console log.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the files_lock app's Lock action in the Files sidebar and the occ files:lock --unlock command, then reproduce the owner and view-only recipient permission cases described above. Done means a view-only recipient cannot lock the file and the owner can unlock a lock created by another user, with the sidebar and command behavior covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, php
- Domain
- authorization, backend, frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100