nextcloud / nextcloud/server

[Bug]: Nested shared folder opens with wrong permissions depending on navigation path

Open
#63,865 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage 32-feedback bug
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

⚠️ This issue respects the following points: ⚠️
  • This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
  • This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
  • I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
  • I agree to follow Nextcloud's Code of Conduct.
  • I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.
Bug description

When i have edit rights on a folder of which the parent folder is also shared with me as read-only, it seems to matter how i navigate to the folder from "All files" for which permissions i get.

I can write (press the "+ New" button) to the folder when opened 'presentaties' from "All files":
https://nextcloud.example.org/apps/files/files/357547?dir=/presentaties

I can only read when opened "presentaties" from "shared with you". It opens as "/werkwijze/presentaties" in "All files":
https://nextcloud.example.org/apps/files/files/357547?dir=/werkwijze/presentaties

Is this designed behavior or a quirk? It often leads to confusion in my organisation.
At least I would expect the shortcut from "shared with you" to work. Since in this list both shares "presentaties" and "werkwijze" can be found.
This has been consistently so in consecutive NC versions.

Steps to reproduce
  1. Create a folder named A.
  2. Inside A, create a subfolder named B.
  3. Share A with User X with read-only permissions.
  4. Separately share B with User X with read/write permissions.
  5. Log in as User X.
  6. Open Files → Shared with you.
  7. Locate the B folder share and open it.
  8. Observe that B is opened through the path /A/B and is read-only. The + New button is unavailable.
  9. Return to All files and open B directly from the root.
  10. Observe that it is opened through /B and is writable. The + New button is available.
Expected behavior

I would expect the same folder to behave independently of how I navigate to it

Nextcloud Server version

32

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?
  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other
Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the navigation difference through Files → Shared with you and All files using the A/B nested-share steps, then trace how each entry point resolves the folder path and effective permissions. Done means B has consistent read/write behavior and the + New button matches the direct share regardless of navigation path.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.