nextcloud / nextcloud/server

Log file access failures leading to 403s (i.e. due to underlying file/folder permissions problems)

Open
#35,205 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement feature: dav feature: filesystem feature: logging
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are interested into the same feature.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.
I was debugging a server recently where some of the folders of a user in the data directory were owned by root instead of www-data. This meant the webserver could not create files in them or move files etc.

Describe the solution you'd like
The server reports 403 - forbidden when the client tried to sync files and also when creating files in the webapp.
In addition it should log errors so it's easier to figure out the root cause.

Describe alternatives you've considered

  • Reporting the issue in the client would be rather confusing and not actionable to the user. It might also leak information in case someone is trying to exploit the server.
  • Not catching the exception would give a nice trace but lead to a 500 send to the client which would be even harder to parse. Also this is not a failure by the nextcloud server but the underlying infrastructure.

Additional context
I don't know if this would have been visible with a higher logging level - how ever the problem seems severe enough to log it even when only logging errors.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files, tests, or entry points. Begin by reproducing the 403 during file synchronization or web-app file creation, then trace where the underlying file or folder permission failure is handled. Done means these failures are logged at error level without exposing sensitive details or turning the response into a 500.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.