nextcloud / nextcloud/server

Prevent users/group from making public links with write/delete permissions.

Open
#29,266 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement feature: sharing security
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
Hello.
I have made group that have read-only permissions and permission to make public links. Still they can choose to make public link with write access. Delete option is not there but users with public link can "change filename".

Describe the solution you'd like
List of available permissions for public links should be inherited from permissions from user that made them.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files or tests are named in the issue. Start by locating the public-link permission handling and the permission-inheritance entry points, then verify that a user or group with read-only access cannot create a public link granting write or delete-like filename changes; add coverage for the reported scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.