nextcloud / nextcloud/server

Group admins should not be able to delete users

Open
#60,224 4 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement feature: users and groups
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

[!TIP]

Help move this idea forward
  • Use the 👍 reaction to show support for this feature.
  • Avoid commenting unless you have relevant information to add; unnecessary comments create noise for subscribers.
  • Subscribe to receive notifications about status changes and new comments.

Users from HR Department Group should be able to only add, remove or move users (from 1 grp to another).
They should not be able to delete users or their data.
How to achieve this?

Is your feature request related to a problem? Please describe.

Describe the solution you'd like

Describe alternatives you've considered

Additional context

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files or tests are named in the issue. Start by locating the server's existing group-admin permission checks for adding, removing, and moving users, then trace the user-deletion path and its data-removal behavior. Done means group admins retain group-management abilities while being prevented from deleting users or their data, with coverage for those permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.