[Bug]: Nested shared folder opens with wrong permissions depending on navigation path
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
⚠️ This issue respects the following points: ⚠️
- This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
- This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
- I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
- I agree to follow Nextcloud's Code of Conduct.
- I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.
Bug description
When i have edit rights on a folder of which the parent folder is also shared with me as read-only, it seems to matter how i navigate to the folder from "All files" for which permissions i get.
I can write (press the "+ New" button) to the folder when opened 'presentaties' from "All files":
https://nextcloud.example.org/apps/files/files/357547?dir=/presentaties
I can only read when opened "presentaties" from "shared with you". It opens as "/werkwijze/presentaties" in "All files":
https://nextcloud.example.org/apps/files/files/357547?dir=/werkwijze/presentaties
Is this designed behavior or a quirk? It often leads to confusion in my organisation.
At least I would expect the shortcut from "shared with you" to work. Since in this list both shares "presentaties" and "werkwijze" can be found.
This has been consistently so in consecutive NC versions.
Steps to reproduce
- Create a folder named
A. - Inside
A, create a subfolder namedB. - Share
Awith User X with read-only permissions. - Separately share
Bwith User X with read/write permissions. - Log in as User X.
- Open Files → Shared with you.
- Locate the
Bfolder share and open it. - Observe that
Bis opened through the path/A/Band is read-only. The + New button is unavailable. - Return to All files and open
Bdirectly from the root. - Observe that it is opened through
/Band is writable. The + New button is available.
Expected behavior
I would expect the same folder to behave independently of how I navigate to it
Nextcloud Server version
32
Operating system
None
PHP engine version
None
Web server
None
Database engine version
None
Is this bug present after an update or on a fresh install?
None
Are you using the Nextcloud Server Encryption module?
None
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
List of activated Apps
Nextcloud Signing status
Nextcloud Logs
Additional info
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the navigation difference through Files → Shared with you and All files using the A/B nested-share steps, then trace how each entry point resolves the folder path and effective permissions. Done means B has consistent read/write behavior and the + New button matches the direct share regardless of navigation path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100