nextcloud / nextcloud/server

[Bug] Reshare dialog offers Edit/Create/Delete from a read-only source, causing a "Cannot increase permissions" error

Open
#61,882 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug feature: sharing
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

Steps to reproduce

  1. As user A, share a folder with user B using Read + Share only (no edit/create/delete).
  2. As user B, open the share dialog and reshare that folder (to a Team, or to another user).
  3. In permissions, note that Edit is offered and enabled (the dialog starts at full permissions).
  4. Leave Edit enabled and save.

Expected

User B can only reshare with the permissions they hold (read + share). Edit / Create / Delete should be disabled or hidden, since B can't grant them.

Actual

The share is rejected with Cannot increase permissions of <path>. B is offered a toggle they can't actually use and only learns that from a backend error.

Suggested fix

Clamp the default and selectable permissions to fileInfo.sharePermissions when resharing, so a read-only resharer can't pick edit/create/delete. Keep the backend guard as the safety net.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the reshare dialog and trace how its permission controls and defaults use fileInfo.sharePermissions; then review the backend permission guard mentioned in the issue. Done means a user with only Read + Share cannot select Edit/Create/Delete when resharing, while the backend guard still rejects invalid permission increases.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, php
Domain
authorization, backend, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.