nextcloud / nextcloud/server

Limit received share interactions

Open
#9,458 10 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop enhancement feature: sharing
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

Currently we allow all users to move files out of shares. However this leads to some scalibility and usability problems.

Assume:

  1. userA has a folder foo with 3 files bar1, bar2, bar3.
  2. Now userA shares foo with groupB
  3. userX, userY and userZ are all part of groupB.
  4. userX moves bar1 out of the share to its own data

Now we have logic in place here that the file gets also moved to the trashbin of userA. But it is still weird behavior wise. Because all of sudden the file is gone for userY and userZ.

If we'd forbid moving files out of shared folder to your own folders (of course if you own the files you can still move whatever you want since they are your files). We'd could improve the handling here. We'd could come up with things like shared trashbins for shared files maybe.

I tried it out on gdrive with @skjnldsv yesterday and they have similar limitations. You can't move files out of a folder shared with you. There is a button 'copy to my drive'. But that is of course different.

This would of course be a big change. But it makes a lot of things simpler. And I guess also easier to explain to users.

Feedback welcome: @skjnldsv @MorrisJobke @nickvergessen @icewind1991 @jancborchardt @schiessle @blizzz @danxuliu

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Begin by tracing how moving files from received shares is handled and how ownership affects the operation; done means users cannot move files they do not own out of shared folders, while owners retain that ability.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.