nextcloud / nextcloud/server

[Bug]: Group admins can not change settings for themselves

Open
#36,758 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop 26-feedback bug feature: settings feature: users and groups
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

⚠️ This issue respects the following points: ⚠️
  • This is a bug, not a question or a configuration/webserver/proxy issue.
  • This issue is not already reported on Github (I've searched it).
  • Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
  • Nextcloud Server is running on 64bit capable CPU, PHP and OS.
  • I agree to follow Nextcloud's Code of Conduct.
Bug description

The account editing is restricted in the UI to not allow editing of the own user (unless it's an admin).
This means group admins can not edit all their members (themselves) via the UI, while the API does not have an issue with the API allows this in general.

The only thing missing also on the API is editing your own quota, which is only allowed for normal admins:
https://github.com/nextcloud/server/blob/b4a29644ccfc1acafcfbdb8b7b887df1fe520166/apps/provisioning_api/lib/Controller/UsersController.php#L805-L808
and is missing the || $subAdminManager->isUserAccessible($currentLoggedInUser, $targetUser) check other similar places have.

Preventing to edit your own quota is a bit useless anyway, as group admins can simply create new accounts with custom quota via the available UI options, so there is no security implication here.

Expected behavior

Editing of own user can be done in the same view as all the other members

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in apps/provisioning_api/lib/Controller/UsersController.php around lines 805-808 and compare the quota permission check with the similar checks mentioned in the issue. Trace the account-editing UI restriction for group admins, then verify that a group admin can edit their own account and quota in the same view as other members.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.