nextcloud / nextcloud/groupfolders
Data from teamfolders can be moved to personal files - ignoring user quota
Open
Nobody has claimed this yet.
0. Needs triage
bug
- Dominant language
- PHP
- Stars
- 343
- Forks
- 106
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 34
Description
How to use GitHub
- Please use the 👍 reaction to show that you are affected by the same issue.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Steps to reproduce
- Create a new team folder and add permissions for a testuser, the testuser needs to have a personal quota of 1GB
- Create a subfolder in the teamfolder and upload a testfile larger than 1GB to it
- On a webdav connection drag & drop the folder into your nextcloud homedirectory (Tested with webdav config added via ubuntu / gnome settings -> online accounts on ubuntu 24.04 ) or in the nextcloud webinterface select move on the subfolder and move it to your personal files
Expected behaviour
Tell us what should happen
The move operation should fail because the quota of the user is too low
Actual behaviour
Tell us what happens instead
The folder is moved to the personal files of the user. It cannot be moved back via webdav or directly in nextcloud. (Error Unable to get header block for files/team_subfolder/testfile.bin)
Server configuration
Operating system: Ubuntu 24.04
Web server: 1.31.1 (nginx:alpine-slim)
Database: mysql 10.11.14
PHP version: 8.4.22
Nextcloud version: (see Nextcloud admin page) 34.0.0
Team folders version: 22.0.0
Updated from an older Nextcloud/ownCloud or fresh install: Fresh install
Where did you install Nextcloud from: Docker
Are you using external storage, if yes which one: No
Are you using encryption: Yes
Are you using an external user-backend, if yes which one: SAML
Client configuration
Browser: Firefox 151.0.4
Operating system: Ubuntu 24.04
Logs
Nextcloud log (data/nextcloud.log)
Nextcloud log
{"reqId":"6qGKMH18Uoq9HTHirIxW","level":3,"time":"2026-06-17T06:26:32+00:00","remoteAddr":"XXX.XXX.XXX.XXX","user":"xxx","app":"webdav","method":"MOVE","url":"/remote.php/webdav/team_subfolder/testfile.bin","scriptName":"/remote.php","message":"Unable to get header block for files/team_subfolder/testfile.bin","userAgent":"gvfs/1.54.4","version":"34.0.0.12","exception":{"Exception":"OCP\\Encryption\\Exceptions\\InvalidHeaderException","Message":"Unable to get header block for files/team_subfolder/testfile.bin","Code":0,"Trace":[{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":170,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Encryption","type":"->","args":["files/team_subfolder/testfile.bin","r"]},{"file":"/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php","line":254,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["files/team_subfolder/testfile.bin","r"]},{"file":"/var/www/html/lib/private/Files/Storage/Common.php","line":559,"function":"fopen","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->","args":["files/team_subfolder/testfile.bin","r"]},{"file":"/var/www/html/lib/private/Files/Storage/Local.php","line":594,"function":"copyFromStorage","class":"OC\\Files\\Storage\\Common","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","files/team_subfolder/testfile.bin"]},{"file":"/var/www/html/lib/private/Files/Storage/Common.php","line":621,"function":"copyFromStorage","class":"OC\\Files\\Storage\\Local","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","files/team_subfolder/testfile.bin",true]},{"file":"/var/www/html/lib/private/Files/Storage/Local.php","line":615,"function":"moveFromStorage","class":"OC\\Files\\Storage\\Common","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","files/team_subfolder/testfile.bin"]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Jail.php","line":286,"function":"moveFromStorage","class":"OC\\Files\\Storage\\Local","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","files/team_subfolder/testfile.bin"]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Quota.php","line":180,"function":"moveFromStorage","class":"OC\\Files\\Storage\\Wrapper\\Jail","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","team_subfolder/testfile.bin"]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":350,"function":"moveFromStorage","class":"OC\\Files\\Storage\\Wrapper\\Quota","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","team_subfolder/testfile.bin"]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":350,"function":"moveFromStorage","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","team_subfolder/testfile.bin"]},{"file":"/var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php","line":350,"function":"moveFromStorage","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","team_subfolder/testfile.bin"]},{"file":"/var/www/html/apps/files_trashbin/lib/Storage.php","line":190,"function":"moveFromStorage","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","team_subfolder/testfile.bin"]},{"file":"/var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php","line":360,"function":"moveFromStorage","class":"OCA\\Files_Trashbin\\Storage","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","team_subfolder/testfile.bin"]},{"file":"/var/www/html/lib/private/Files/View.php","line":834,"function":"moveFromStorage","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->","args":[{"__class__":"OCA\\FilesAccessControl\\StorageWrapper","cache":null,"scanner":{"__class__":"OC\\Files\\Cache\\Scanner"},"watcher":null,"propagator":null,"updater":null,"mountPoint":"/userxxx/"},"files/team_subfolder/testfile.bin","team_subfolder/testfile.bin"]},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Directory.php","line":454,"function":"rename","class":"OC\\Files\\View","type":"->","args":["/team_subfolder/testfile.bin","/Test/team_subfolder/testfile.bin"]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Tree.php","line":178,"function":"moveInto","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["testfile.bin","team_subfolder/testfile.bin",{"__class__":"OCA\\DAV\\Connector\\Sabre\\File"}]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":612,"function":"move","class":"Sabre\\DAV\\Tree","type":"->","args":["team_subfolder/testfile.bin","Test/team_subfolder/testfile.bin"]},{"file":"/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpMove","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->","args":["method:MOVE",[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Server.php","line":215,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/var/www/html/apps/dav/appinfo/v1/webdav.php","line":87,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->","args":[]},{"file":"/var/www/html/remote.php","line":152,"args":["/var/www/html/apps/dav/appinfo/v1/webdav.php"],"function":"require_once"}],"File":"/var/www/html/lib/private/Files/Storage/Wrapper/Encryption.php","Line":364,"Hint":"Unable to get header block for files/team_subfolder/testfile.bin","message":"Unable to get header block for files/team_subfolder/testfile.bin","exception":"{\"class\":\"OCP\\Encryption\\Exceptions\\InvalidHeaderException\",\"message\":\"Unable to get header block for files/team_subfolder/testfile.bin\",\"code\":0,\"file\":\"/var/www/html/lib/private/Files/Storage/Wrapper/Encryption.php:364\",\"trace\":\"#0 /var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php(170): OC\\Files\\Storage\\Wrapper\\Encryption->fopen('files/team_subf...', 'r')\\n#1 /var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php(254): OC\\Files\\Storage\\Wrapper\\Wrapper->fopen('files/team_subf...', 'r')\\n#2 /var/www/html/lib/private/Files/Storage/Common.php(559): OCA\\FilesAccessControl\\StorageWrapper->fopen('files/team_subf...', 'r')\\n#3 /var/www/html/lib/private/Files/Storage/Local.php(594): OC\\Files\\Storage\\Common->copyFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'files/team_subf...')\\n#4 /var/www/html/lib/private/Files/Storage/Common.php(621): OC\\Files\\Storage\\Local->copyFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'files/team_subf...', true)\\n#5 /var/www/html/lib/private/Files/Storage/Local.php(615): OC\\Files\\Storage\\Common->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'files/team_subf...')\\n#6 /var/www/html/lib/private/Files/Storage/Wrapper/Jail.php(286): OC\\Files\\Storage\\Local->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'files/team_subf...')\\n#7 /var/www/html/lib/private/Files/Storage/Wrapper/Quota.php(180): OC\\Files\\Storage\\Wrapper\\Jail->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'team_subfolder/...')\\n#8 /var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php(350): OC\\Files\\Storage\\Wrapper\\Quota->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'team_subfolder/...')\\n#9 /var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php(350): OC\\Files\\Storage\\Wrapper\\Wrapper->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'team_subfolder/...')\\n#10 /var/www/html/lib/private/Files/Storage/Wrapper/Wrapper.php(350): OC\\Files\\Storage\\Wrapper\\Wrapper->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'team_subfolder/...')\\n#11 /var/www/html/apps/files_trashbin/lib/Storage.php(190): OC\\Files\\Storage\\Wrapper\\Wrapper->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'team_subfolder/...')\\n#12 /var/www/html/custom_apps/files_accesscontrol/lib/StorageWrapper.php(360): OCA\\Files_Trashbin\\Storage->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'team_subfolder/...')\\n#13 /var/www/html/lib/private/Files/View.php(834): OCA\\FilesAccessControl\\StorageWrapper->moveFromStorage(Object(OCA\\FilesAccessControl\\StorageWrapper), 'files/team_subf...', 'team_subfolder/...')\\n#14 /var/www/html/apps/dav/lib/Connector/Sabre/Directory.php(454): OC\\Files\\View->rename('/team_subfolder...', '/Test/team_subf...')\\n#15 /var/www/html/3rdparty/sabre/dav/lib/DAV/Tree.php(178): OCA\\DAV\\Connector\\Sabre\\Directory->moveInto('testfile.bin', 'team_subfolder/...', Object(OCA\\DAV\\Connector\\Sabre\\File))\\n#16 /var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(612): Sabre\\DAV\\Tree->move('team_subfolder/...', 'Test/team_subfo...')\\n#17 /var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpMove(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#18 /var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit('method:MOVE', Array)\\n#19 /var/www/html/apps/dav/lib/Connector/Sabre/Server.php(215): Sabre\\DAV\\Server->invokeMethod(Object(Sabre\\HTTP\\Request), Object(Sabre\\HTTP\\Response))\\n#20 /var/www/html/apps/dav/appinfo/v1/webdav.php(87): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#21 /var/www/html/remote.php(152): require_once('/var/www/html/a...')\\n#22 {main}\"}","CustomMessage":"Unable to get header block for files/team_subfolder/testfile.bin"}}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the MOVE path in apps/dav/lib/Connector/Sabre/Directory.php and trace the quota and storage-wrapper calls named in the log, especially lib/private/Files/Storage/Wrapper/Quota.php and lib/private/Files/View.php. Reproduce the team-folder-to-personal-files move with a 1GB user quota and verify that an oversized move is rejected without leaving the file inaccessible or misplaced.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100