nextcloud / nextcloud/groupfolders

Prevent received shares to stay on top of group folders

Open
#2,178 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop bug feature: sharing hot spot: collisions
Dominant language
PHP
Stars
343
Forks
106
Avg merge
2d 3h
Merged PRs (30d)
34

Description

This was with NC 24.0.5

Steps
  1. Create two users "alice" and "bob" into a group "group1"
  2. Login as "alice"
  3. Create a folder "share"
  4. Create a subfolder "share/in_share"
  5. Share "share" with "bob"
  6. Login as "bob"
  7. Create a folder "futuregroupfolder"
  8. Move "share" to "/futuregroupfolder/share". This puts the mount point on the legit folder "exists"
  9. Now we override the subdir with a group folder: as admin, create a group folder called "futuregroupfolder" and apply for the group "group1" and "admin"
  10. Put a folder as admin in "futuregroupfolder/in_groupfolder"
  11. Login as "bob"
  12. Enter "futuregroupfolder" and observe
  13. Check the oc_shar etable

=> The group folder contains both the contents "in_groupfolder" and also the received share "share" with its contents "in_share".
=> the oc_share table has a file_target pointing at "/futuregroupfolder/share"

I've seen a case where this situation was the best for an infinite loop of sorts which I couldn't reproduce yet.

In any case we should prevent such scenarios, not sure how.

When creating or renaming a group folder, detecting collisions for each users would be too expensive.
Maybe something needs to be done in the mount manager initially to detect mount point overlaps and resolve them.
Or in the sharing code verifyMountPoints where duplicate detection is happening, and check also every parent to make sure they are not point points ?

Thoughts ? @icewind1991 @CarlSchwan

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the folder and group-folder collision described in the steps, then inspect the mount manager and sharing code around verifyMountPoints. Check the resulting oc_share file_target and whether parent mount points overlap. Done means the received share is not exposed inside the group folder and the collision cannot create an infinite loop.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.