Multiple regressions in TeamFolders > 21.0.0 : ACL aren’t applied properly anymore

[Jerome-Herbinet]

Steps to reproduce

1. Having a TF configured with two groups, a reader group (R----) and an updater group (RWCD-).  We have a root dir with those permissions, and a ‘subdir’ directory inside. My user is part of both groups
2. Can’t write, create or delete anything inside this TF. It seems like my “reader” permissions are overriding my “updater” permissions.

Expected behaviour

Being part of the “updater” group, I should be able to write, create and delete files, as before in Nextcloud. ACL calculation seem to have changed since > 21.0.0 which is very impactful on pre-existing folder structure.

Actual behaviour

I can’t write, create or delete inside the directory, even though I’m part of the “updater” group which have all the permissions.

Server configuration

• NC 33.0.3
• TF 21.0.7
    ◦ acl-inherit-per-user is true

Tested on multiple Nextcloud Instances

Reported by @ThibautPlg

[Adfinis-Freund]

I can confirm this behavior with version 21.0.7 and NC 33.0.3. From my perspective, this presents a significant issue for those who already have a complex setup and are upgrading Nextcloud to v33.

However, version 20.1.13 with NC 32.0.9 works perfectly.
Unfortunately, I haven't had the time to investigate the issue further.

[MPStudyly]

Might be related to #4695

[Jerome-Herbinet]

Other related issues submitted at the same time (same related context):

• Multiple regressions in TeamFolders > 21.0.0 : Can’t override more than one inherited ACL #4706
• Multiple regressions in TeamFolders > 21.0.0 : The names of the user groups and users targeted by advanced permission rules are no longer visible #4708
• Multiple regressions in TeamFolders > 21.0.0 : So-called “inherited” (or undefined) rules are no longer visually identifiable #4709
• Multiple regressions in TeamFolders > 21.0.0 : inherited ACL rules are always displayed as denied #4710

[icewind1991]

I think this might be a frontend issue with the UI no longer distinguishing between "allow by default because no rule is set" and "allowed explicitly".

Can you hover over the checkmark and see if the tooltip says "Allowed" or "Allowed (Inherited permission)"

[icewind1991]

Seems to be caused by 57980e9

cc @provokateurin

[icewind1991]

If this is indeed a UI issue, then #4713 will fix it

[MPStudyly]

If this is indeed a UI issue, then #4713 will fix it

It might be a UI issue, but not exclusively. I'd generally wonder why a UI issue would have impact on how ACLs are applied in the backend, as long as it is not messing up stored ACLs. See #4695