nextcloud / nextcloud/polls

Enable logged-in users to access polls by personal url recieved by mail

Open
#4,978 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

new
Dominant language
JavaScript
Stars
284
Forks
91
Avg merge
4d 3h
Merged PRs (30d)
50

Description

⚠️ This issue respects the following points: ⚠️
Describe the goal you'd like to achieve

As a poll participant that is already logged-in to Nextcloud, I want to be able to access polls by direct url received by mail. At the moment, if a poll owner sends an invite to multiple people using a list of mail addresses the single person receives a mail with a personalized url in it. If a already logged-in user clicks on this link the user sees a error message that the poll can't be accessed.
The problem resides in the fact that polls seams to check if the already logged-in user has access rights to the specific poll. If the user hasn't polls refuses to open the link even tough the user is in possession of the "secret" needed to access the poll (= the url).

This previously was reported as bug in #4975

Describe possible solutions

In my opinion a user that is logged in should always be able to open these types personal links (if the user is in possession of this "secret" this should be enough to grant him access to the poll).

Additional context

At the first thought this seams like additional security, but it isn't: if the user simply opens a private tab the url of the poll can be accessed. Therefore IMHO it makes no sense to show an error message to the user when already logged-in.
This specially is a problem to enterprise users that need to create polls to many people and therefore use the option to send the invitation links to many addresses.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how personalized poll invitation URLs are handled for logged-in users and where poll access rights are checked. Verify that a logged-in recipient with the invitation URL can open the poll, while existing access behavior remains unchanged; the issue does not name specific files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.