nextcloud / nextcloud/groupfolders

Effective permissions test (`--test`) is wrong for users outside the group

Open
#974 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop bug feature: acl feature: occ
Dominant language
PHP
Stars
343
Forks
106
Avg merge
2d 3h
Merged PRs (30d)
34

Description

Hello,

i'm having the efffect that the output for --test with a user outside of an allowed group shows as result always +read, + write, +create, +delete, +share

Most likely one would test it with a user who is in a group with access to the groupfolder, so this was not discovered.
But since there is also the possiblity that a user has the mentioned access rights, it is misleading if users are displayed with +all when in fact they are forbidden completly.

It appears the permissions are enforced correct and only the output of occ is wrong.
At least there is no groupfolder displayed for users outside of the group, but I'm not sure if there is really not some way to access it.

I think there are two possible ways to solve this:

  • return "user not in group with access" (analog to "user does not exist")
  • return the correct access rights, which would be -read, -write, -create, -delete, -share

Of course if this is not only the output from occ which is wrong, then there is a bigger problem...

Nextcloud 19.0.0
Groupfolders 6.0.6

Steps to reproduce:
create a group folder, enable advanced permissions
try occ groupfolders:permissions <folder_id> --user <a_user_outside_an_allowed_group> <some_path> --test
output: +read, +write, +create, +delete, +share

Greetings,
Uno

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the occ groupfolders:permissions command and reproduce the --test case using a user outside an allowed group. Trace how effective permissions are calculated and formatted for that user, then verify that the output reflects denied access or clearly reports that the user is not in an allowed group.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.