nextcloud / nextcloud/groupfolders
Effective permissions test (`--test`) is wrong for users outside the group
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 343
- Forks
- 106
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 34
Description
Hello,
i'm having the efffect that the output for --test with a user outside of an allowed group shows as result always +read, + write, +create, +delete, +share
Most likely one would test it with a user who is in a group with access to the groupfolder, so this was not discovered.
But since there is also the possiblity that a user has the mentioned access rights, it is misleading if users are displayed with +all when in fact they are forbidden completly.
It appears the permissions are enforced correct and only the output of occ is wrong.
At least there is no groupfolder displayed for users outside of the group, but I'm not sure if there is really not some way to access it.
I think there are two possible ways to solve this:
- return "user not in group with access" (analog to "user does not exist")
- return the correct access rights, which would be
-read, -write, -create, -delete, -share
Of course if this is not only the output from occ which is wrong, then there is a bigger problem...
Nextcloud 19.0.0
Groupfolders 6.0.6
Steps to reproduce:
create a group folder, enable advanced permissions
try occ groupfolders:permissions <folder_id> --user <a_user_outside_an_allowed_group> <some_path> --test
output: +read, +write, +create, +delete, +share
Greetings,
Uno
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the occ groupfolders:permissions command and reproduce the --test case using a user outside an allowed group. Trace how effective permissions are calculated and formatted for that user, then verify that the output reflects denied access or clearly reports that the user is not in an allowed group.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authorization, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100