nextcloud / nextcloud/server

[Bug]: Delete user - Wipe all devices - Disable user

Open
#38,643 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage client: 💻 desktop client: 🤖🍏 mobile feature: authentication feature: users and groups overview technical debt
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

⚠️ This issue respects the following points: ⚠️
  • This is a bug, not a question or a configuration/webserver/proxy issue.
  • This issue is not already reported on Github (I've searched it).
  • Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
  • Nextcloud Server is running on 64bit capable CPU, PHP and OS.
  • I agree to follow Nextcloud's Code of Conduct.
Bug description

According to client management the functions for deleting a user are not correctly handled.

-1-
If you delete a user clients get a 401 http error (JSON internal error 997) we are then forced to block the flow, delete the password and immediately request new credentials, which would practically also mean deleting the internal files as server-side, otherwise one would not understand why deleting a user and leaving the data within the client would take up so much space on the phone.

So you don't understand the real difference between delete user and wipe all devices

-2-
Disabling the user should be momentary, so that temporarily the client no longer has access to the server (although it can still consult the local data?). But on the client side there is no difference between Delete user and Disable user (error 401 JSON error 997) which would still mean having to request credentials with the login mask.

-3-
For more than a few customers, it happens that the user on his phone inexplicably receives a 401 and is forced to log in, are we sure that on the server side nobody has disabled the user so this 401 was generated somewhere .

Steps to reproduce
  1. select a user
  2. choice an option for delete / wipe / disable
Expected behavior

-1-
the duplicate of Delete user / Wipe all device should simply be "Delete user" I would like to remind you that at least under iOS, the data in the sandbox is and will remain unlawful, so even if you do not destroy the local data, it will remain unusable.

-2-
use a different error between delete and disable.

-3-
Deleting or disabling a user should generate an error that is not a 401 standad as it can happen in other contexts as well.

Installation method

None

Nextcloud Server version

26

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?
  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other
Configuration report

No response

List of activated Apps
not required for this type of issue.
Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report names no source files, tests, logs, or specific entry points. Start by reproducing the Delete user, Wipe all devices, and Disable user actions on Nextcloud Server 26, then compare the resulting client responses and local-data behavior. Done means the three operations have clearly defined, distinct behavior and verified client-facing errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
18/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.