Restoring of deleted shared file inside folder inside groupfolder not possible #3339
Open
Description
How to use GitHub
- Please use the 👍 reaction to show that you are affected by the same issue.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Steps to reproduce
- Create a groupfolder "A" with ACL and give readonly permissions to user "A"
- Create a folder "B" inside groupfolder "A" and give full access to user "A"
- Share the folder with full permissions to another user "B"
- Create a file inside "C" and share it with another user "B"
- Login to the other user "B" and delete file "C"
- Try to restore the file with any of the users "A" or "B".
Expected behaviour
The file should be able to be restorable, with at least user "A".
Actual behaviour
The request results in http status 500 with a NotPermittedException.
I've noticed that the original_location column in table oc_group_folders_trash doesn't contain the folder B, but just the name of file C with the folder_id of groupfolder A. I think this results in a bad ACL check.
Server configuration
Operating system: Alpine; Docker
Web server: Nginx
Database: MySQL (Galera)
PHP version: 8.2.7
Nextcloud version: 28.0.9
Group folders version: 16.0.8
Updated from an older Nextcloud/ownCloud or fresh install: fresh install
Where did you install Nextcloud from: official source; self-built docker image
Are you using external storage, if yes which one: s3
Are you using encryption: no
Are you using an external user-backend, if yes which one: no
Client configuration
Browser: Chrome
Operating system: MacOS 15
Logs
Web server error log
Web server error log
127.0.0.1 - 10/Oct/2024:08:22:58 +0000 "MOVE /remote.php" 500
Nextcloud log (data/nextcloud.log)
Nextcloud log
{"reqId":"EEyWFwynx1WX0OSYUjAx","level":3,"time":"2024-10-10T08:22:58+00:00","remoteAddr":"CENSORED","user":"jesser","app":"webdav","method":"MOVE","url":"/remote.php/dav/trashbin/jesser/trash/Neue%20Textdatei.txt.d1728548573","message":"Exception thrown: OCP\\Files\\NotPermittedException","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36","version":"28.0.9.1","exception":{"Exception":"OCP\\Files\\NotPermittedException","Message":"","Code":0,"Trace":[{"file":"/var/www/html/apps/files_trashbin/lib/Trash/TrashManager.php","line":64,"function":"restoreItem","class":"OCA\\GroupFolders\\Trash\\TrashBackend","type":"->","args":[["OCA\\GroupFolders\\Trash\\GroupTrashItem"]]},{"file":"/var/www/html/apps/files_trashbin/lib/Sabre/AbstractTrash.php","line":97,"function":"restoreItem","class":"OCA\\Files_Trashbin\\Trash\\TrashManager","type":"->","args":[["OCA\\GroupFolders\\Trash\\GroupTrashItem"]]},{"file":"/var/www/html/apps/files_trashbin/lib/Sabre/RestoreFolder.php","line":75,"function":"restore","class":"OCA\\Files_Trashbin\\Sabre\\AbstractTrash","type":"->","args":[]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Tree.php","line":178,"function":"moveInto","class":"OCA\\Files_Trashbin\\Sabre\\RestoreFolder","type":"->","args":["Neue Textdatei.txt.d1728548573","trashbin/jbebendorf/trash/Neue Textdatei.txt.d1728548573",["OCA\\Files_Trashbin\\Sabre\\TrashFile"]]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":612,"function":"move","class":"Sabre\\DAV\\Tree","type":"->","args":["trashbin/jbebendorf/trash/Neue Textdatei.txt.d1728548573","trashbin/jbebendorf/restore/Neue Textdatei.txt.d1728548573"]},{"file":"/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpMove","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->","args":["method:MOVE",[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[["Sabre\\HTTP\\Request"],["Sabre\\HTTP\\Response"]]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/var/www/html/apps/dav/lib/Server.php","line":382,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/var/www/html/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->","args":[]},{"file":"/var/www/html/remote.php","line":172,"args":["/var/www/html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/custom_apps/groupfolders/lib/Trash/TrashBackend.php","Line":129,"message":"","exception":{},"CustomMessage":"Exception thrown: OCP\\Files\\NotPermittedException"}}
Metadata
Assignees
Type
Projects
Status
📄 To do (~10 entries)