nextcloud / nextcloud/groupfolders

Delete Error if advanced permissions ON

Open
#5,010 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage bug
Dominant language
PHP
Stars
343
Forks
106
Avg merge
2d 3h
Merged PRs (30d)
34

Description

Steps to reproduce
  1. create a team with some users
  2. create team folder with that group (do not grant advanced permissions per default)
  3. add one user at "Advanced Permissons
  4. login as that user -> grant advanced permissions to team-folder/team (incl. "delete")
  5. create a file or folder within the teamfolder and try to delete it
Expected behaviour

file is deleted or moved to trash-bin

Actual behaviour

error message: "Datei löschen: Fehlgeschlagen" (error deleting file)

Server configuration

Operating system:
ubuntu 24.04

Web server:
apache2

Database:
mariadb-server 10.11.14

PHP version:
PHP 8.3.6

Nextcloud version: (see Nextcloud admin page)
(34.0.2)

Team folders version:
22.0.6

Updated from an older Nextcloud/ownCloud or fresh install:
updated several versions

Where did you install Nextcloud from:
github upstream

Are you using external storage, if yes which one: local/s3/smb/sftp/...
no

Are you using encryption: yes/no
no

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/Saml/...
demo no / production yes LDAP (both show same error)

Client configuration

Browser:
Linux Firefox (current)

Operating system:
Ubuntu 24.04

Logs
Web server error log
Nextcloud log (data/nextcloud.log)
Nextcloud log 
{"reqId":"49T7UcIJjflGsUuLL3VA","level":1,"time":"2026-08-10T11:18:01+00:00","remoteAddr":"a.b.c.d","user":"feuser1","app":"no app in context","method":"DELETE","url":"/remote.php/dav/files/feuser1/TEAM2/eins","scriptName":"/remote.php","message":"The app config key dav/enableCalendarFederation is not defined in the config lexicon","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","version":"34.0.2.1","data":[]}
{"reqId":"49T7UcIJjflGsUuLL3VA","level":1,"time":"2026-08-10T11:18:01+00:00","remoteAddr":"a.b.c.d","user":"feuser1","app":"no app in context","method":"DELETE","url":"/remote.php/dav/files/feuser1/TEAM2/eins","scriptName":"/remote.php","message":"The app config key dav/sendInvitations is not defined in the config lexicon","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","version":"34.0.2.1","data":[]}
{"reqId":"49T7UcIJjflGsUuLL3VA","level":0,"time":"2026-08-10T11:18:01+00:00","remoteAddr":"a.b.c.d","user":"feuser1","app":"webdav","method":"DELETE","url":"/remote.php/dav/files/feuser1/TEAM2/eins","scriptName":"/remote.php","message":"Exception thrown: Sabre\\DAV\\Exception\\Forbidden","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","version":"34.0.2.1","exception":{"Exception":"Sabre\\DAV\\Exception\\Forbidden","Message":"","Code":0,"Trace":[{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Tree.php","line":197,"function":"delete","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":281,"function":"delete","class":"Sabre\\DAV\\Tree","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpDelete","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Server.php","line":215,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Server.php","line":432,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/remote.php","line":152,"args":["/srv/demo2/nextcloud-34.0.2/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Directory.php","Line":318,"message":"","exception":"{\"class\":\"Sabre\\DAV\\Exception\\Forbidden\",\"message\":\"\",\"code\":0,\"file\":\"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Directory.php:318\",\"trace\":\"#0 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Tree.php(197): OCA\\DAV\\Connector\\Sabre\\Directory->delete()\\n#1 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(281): Sabre\\DAV\\Tree->delete()\\n#2 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpDelete()\\n#3 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#4 /srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Server.php(215): Sabre\\DAV\\Server->invokeMethod()\\n#5 /srv/demo2/nextcloud-34.0.2/apps/dav/lib/Server.php(432): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#6 /srv/demo2/nextcloud-34.0.2/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#7 /srv/demo2/nextcloud-34.0.2/remote.php(152): require_once('...')\\n#8 {main}\"}","CustomMessage":"Exception thrown: Sabre\\DAV\\Exception\\Forbidden"}}
{"reqId":"49T7UcIJjflGsUuLL3VA","level":1,"time":"2026-08-10T11:18:01+00:00","remoteAddr":"a.b.c.d","user":"feuser1","app":"no app in context","method":"DELETE","url":"/remote.php/dav/files/feuser1/TEAM2/eins","scriptName":"/remote.php","message":"Uncaught exception","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","version":"34.0.2.1","exception":{"Exception":"Sabre\\DAV\\Exception\\Forbidden","Message":"","Code":0,"Trace":[{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Tree.php","line":197,"function":"delete","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":281,"function":"delete","class":"Sabre\\DAV\\Tree","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpDelete","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Server.php","line":215,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Server.php","line":432,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/srv/demo2/nextcloud-34.0.2/remote.php","line":152,"args":["/srv/demo2/nextcloud-34.0.2/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Directory.php","Line":318,"message":"Uncaught exception","exception":"{\"class\":\"Sabre\\DAV\\Exception\\Forbidden\",\"message\":\"\",\"code\":0,\"file\":\"/srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Directory.php:318\",\"trace\":\"#0 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Tree.php(197): OCA\\DAV\\Connector\\Sabre\\Directory->delete()\\n#1 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(281): Sabre\\DAV\\Tree->delete()\\n#2 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpDelete()\\n#3 /srv/demo2/nextcloud-34.0.2/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#4 /srv/demo2/nextcloud-34.0.2/apps/dav/lib/Connector/Sabre/Server.php(215): Sabre\\DAV\\Server->invokeMethod()\\n#5 /srv/demo2/nextcloud-34.0.2/apps/dav/lib/Server.php(432): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#6 /srv/demo2/nextcloud-34.0.2/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#7 /srv/demo2/nextcloud-34.0.2/remote.php(152): require_once('...')\\n#8 {main}\"}","CustomMessage":"Uncaught exception"}
Browser log

misc

groupfolders:permissions 4 --disable == user can delete
groupfolders:permissions 4 --enable == user cannot delete

in both cases user/group has "delete permission" on root folder

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at apps/dav/lib/Connector/Sabre/Directory.php:318, where the DELETE request raises Sabre\DAV\Exception\Forbidden, and trace how advanced permissions from groupfolders are evaluated. Reproduce the listed team-folder setup with permissions 4 disabled and enabled, then verify that a user with delete permission can delete or move the item to the trash bin in both cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.