Sharing a folder inside a password protected conversation makes it public and not password protected
Open
Nobody has claimed this yet.
bug
feature: upload & shares & voice 📤🎙️
- Dominant language
- PHP
- Stars
- 2.2k
- Forks
- 587
- Avg merge
- 18h 27m
- Merged PRs (30d)
- 333
Description
Steps to reproduce
- Create new conversation
- Allow guests to join via link
- Set a password
- Share a folder inside the conversation
- Logout
- Open the conversation without beeing logged in
- Use the password you set bevore
- Klick on the shared folder
- Copy the link of the new browser tab that showes the shared folder
- Open a new private browser window
- Paste the link and get access to the shared folder without the password
Expected behaviour
In step 8 i should be asked for the password of the conversation.
Actual behaviour
I can access the folder without any password.
Talk app
version 9.0.6
no Custom Signaling server configured
coturn as Custom TURN and STUN server configured
Browser
Firefox
Server configuration
Ubuntu Server 20.04
MySQL
Nextcloud 19.0.5
also tested on a 18.0.4.2 Nextcloud with unkown Talk version
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the shared-folder access flow described in the issue on a password-protected conversation, then inspect the code paths used when the folder link opens in a separate browser window. Done means the copied folder link still requires the conversation password when opened in a private window.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100