nextcloud / nextcloud/groupfolders
Public share with read-only permissions allows creating folders in Team Folders
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 343
- Forks
- 106
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 34
Description
Environment
- Nextcloud: 34.0.0.12
- Team Folders (Groupfolders): 22.0.6
Issue
When creating a public link for a Team Folder subfolder with custom permissions:
- Read: enabled
- Create: disabled
- Edit: disabled
- Delete: disabled
the public share is created correctly.
The oc_share table shows:
permissions = 17
(Read + Share)
However, when opening the public link as an anonymous user, the interface shows the "+ New" button and it is possible to create new folders inside the shared folder.
Expected behavior
The public share should be read-only and should not allow creating folders or uploading files.
Additional information
- Advanced Permissions are disabled.
- The share is stored in oc_share with permissions = 17.
- The issue only occurs inside Team Folders (Groupfolders).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with Nextcloud 34.0.0.12 and Team Folders 22.0.6 using a public link to a Team Folder subfolder with permissions = 17. Trace the Team Folders handling of anonymous public-share permissions and verify that the "+ New" action, folder creation, and uploads are unavailable when Create, Edit, and Delete are disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100