nextcloud / nextcloud/richdocuments

"Restrict edit to specific groups" still possible via Direct Edit

Open
#4,096 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug client: 🤖🍏 mobile feature: direct editor feature: settings
Dominant language
JavaScript
Stars
453
Forks
147
Avg merge
14h 54m
Merged PRs (30d)
83

Description

⚠️ Before posting ⚠️
  • This is a bug, not a question or an enhancement.
  • I've searched for similar issues and didn't find a duplicate.
  • I've written a clear and descriptive title for this issue, not just "Bug" or "Crash".
  • I agree to follow Nextcloud's Code of Conduct.
Steps to reproduce
  1. Restrict edit to specific groups in administration settings of Nextcloud Office, e.g. to only one special group
  2. A user not in this special group can not edit an Office Document via browser anymore, even having write rights to this document or the containing folder --> as expected
  3. BUT opening the same Office Document via the mobile client still shows the edit button and by pressing the edit button this user can even edit this Office Document, as long he/she has write rights to this document or the containing folder, but is excluded as Office Document editor via the administration settings of Nextcloud Office.
Expected behaviour

When an user is not in a group, which is listed in "Restrict edit to specific groups" in administration settings of Nextcloud Office, he/she should not be able to edit an Office Document in the mobile client.

Actual behaviour

"Restrict edit to specific groups" in administration settings of Nextcloud Office is ignored by the mobile client.

Btw. same on iPhone mobile client

Android version

12 and 11

Device brand and model

LG G8 and Lenovo Tablet

Stock or custom OS?

Stock

Nextcloud android app version

3.24.1

Nextcloud server version

25.0.3

Using a reverse proxy?

No

Android logs

No response

Server error logs

No response

Additional information

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the Direct Edit path used by the mobile client and compare its permission handling with the browser behavior for Nextcloud Office documents. Reproduce the group restriction with a user who has document write rights but is excluded from the allowed group. Done means the mobile client no longer offers or permits editing for that user.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authorization, mobile-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.