nextcloud / nextcloud/groupfolders

Renaming a groupfolder when server side encryption is enabled makes contained files unavailable

Open
#3,733 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage bug
Dominant language
PHP
Stars
343
Forks
106
Avg merge
2d 3h
Merged PRs (30d)
34

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.
Steps to reproduce
  1. Setup Server side encryption
  2. Enable server-side encryption in groupfolders
  3. Create a groupfolder
  4. Upload some files into the groupfolder
  5. Rename the groupfolder in the admin interface
  6. Uploaded files can no longer be read
Expected behaviour

The files should still be readable

Actual behaviour

The key for the files can not be found.

Server configuration

Operating system: *

Web server: *

Database: *

PHP version: *

Nextcloud version: 30.0.8 (see Nextcloud admin page)

Team folders version: 18.1.2

Updated from an older Nextcloud/ownCloud or fresh install: N/A

Where did you install Nextcloud from: from source

Are you using external storage, if yes which one: no

Are you using encryption: yes

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: *

Operating system: *

Logs
Web server error log
Web server error log 
Insert your webserver log here
Nextcloud log (data/nextcloud.log)
Nextcloud log 
{"reqId":"rxSrtHLOFb9KE6TtIAgt","level":3,"time":"2025-04-07T12:11:53+00:00","remoteAddr":"127.0.0.1","user":"admin","app":"webdav","method":"GET","url":"/remote.php/dav/files/admin/goroupfolderafterrename/Screenshot%20from%202025-02-25%2010-13-03.png","message":"Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0","version":"30.0.8.1","exception":{"Exception":"OC\\Encryption\\Exceptions\\DecryptionFailedException","Message":"Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.","Code":0,"Trace":[{"file":"/home/marcel/code/stable31-sse/lib/private/Files/Stream/Encryption.php","line":493,"function":"decrypt","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/marcel/code/stable31-sse/lib/private/Files/Stream/Encryption.php","line":292,"function":"readCache","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"function":"stream_read","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/home/marcel/code/stable31-sse/3rdparty/icewind/streams/src/Wrapper.php","line":55,"function":"fread"},{"file":"/home/marcel/code/stable31-sse/3rdparty/icewind/streams/src/CallbackWrapper.php","line":96,"function":"stream_read","class":"Icewind\\Streams\\Wrapper","type":"->"},{"function":"stream_read","class":"Icewind\\Streams\\CallbackWrapper","type":"->"},{"file":"/home/marcel/code/stable31-sse/3rdparty/sabre/http/lib/Sapi.php","line":110,"function":"stream_copy_to_stream"},{"file":"/home/marcel/code/stable31-sse/3rdparty/sabre/dav/lib/DAV/Server.php","line":490,"function":"sendResponse","class":"Sabre\\HTTP\\Sapi","type":"::"},{"file":"/home/marcel/code/stable31-sse/apps/dav/lib/Connector/Sabre/Server.php","line":49,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/marcel/code/stable31-sse/apps/dav/lib/Server.php","line":374,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/home/marcel/code/stable31-sse/apps/dav/appinfo/v2/remote.php","line":19,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/home/marcel/code/stable31-sse/remote.php","line":146,"args":["/home/marcel/code/stable31-sse/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/home/marcel/code/stable31-sse/apps/encryption/lib/Crypto/Encryption.php","Line":314,"Hint":"Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.","message":"Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you.","exception":{"xdebug_message":null},"CustomMessage":"Cannot decrypt this file, probably this is a shared file. Please ask the file owner to reshare the file with you."}}
Browser log
Browser log 
Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported reproduction steps and inspect apps/encryption/lib/Crypto/Encryption.php, especially the decryption failure shown in the log. Trace the groupfolder rename path and how it relates to the missing file key. Done means files remain readable after renaming a groupfolder with server-side encryption enabled, with a regression test covering the scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.