owncloud / owncloud/core

Cannot view or delete groups with a slash in their name using provisioning API

Open
#31,015 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type:Bug
Dominant language
PHP
Stars
8.8k
Forks
2.1k
Avg merge
20h 7m
Merged PRs (30d)
41

Description

You can create groups with all sorts of names in the webUI or with the provisioning API like:

curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups -X POST -d "groupid=q?mark"
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups -X POST -d "groupid=a%sign"
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups -X POST -d "groupid=a/slash"

and other special characters.

You can list all groups fine with:

curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups

And view individual groups with:

curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a%sign

and to get a "?" through, you have to put the escaped value "%3F"

curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/q%3Fmark

You can delete such groups with:

curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a%sign -X DELETE
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/q%3Fmark -X DELETE

The problem comes if you try with groups that have a / in their name. A literal slash is never going to work:

curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a/slash

And an escaped slash, like this, is rejected by the server (Apache or PHP dev server):

curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a%2Fslash

So you cannot manage a group like a/slash via the provisioning API. But you can manage it through webUI.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the provisioning API requests in the issue for groups named a/slash, including literal and escaped slashes. Trace how the API and server handle the group name in view and DELETE requests; done means both operations work for slash-containing groups without regressing the existing special-character cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.