镜像站点 · 本页由第三方 GitHub 只读镜像提供，非 GitHub 官方站点，不接受任何登录或凭据输入。前往 github.com
Skip to content

Users in groups excluded from sharing can initiate shares if also a member of a non-excluded group #3387

Open
Open
Users in groups excluded from sharing can initiate shares if also a member of a non-excluded group#3387
Labels
1. to developAccepted and waiting to be taken care ofenhancementfeature: sharingneeds reviewNeeds review to determine if still applicable or covered by other Issues

Description

@Zulgrib
Zulgrib
opened on Feb 6, 2017

Steps to reproduce

  1. Create a "No sharing" group
  2. Add a user to "No sharing" group
  3. Configure to not allow "No sharing" group to initiate shares
  4. Share folder with another user

Expected behaviour

The user shouldn't be able to initiate a share

Actual behaviour

The user initiate a share successfully that can be seen and modified by target user

Server configuration

Operating system:
Shared host

Web server:
Apache

Database:
MySQL 5.6.34

PHP version:
7.0.15

Nextcloud version: (see Nextcloud admin page)
11.0.0
Updated from an older Nextcloud/ownCloud or fresh install:
Fresh
Where did you install Nextcloud from:
Unarchive archive file downloaded from nextcloud site
Signing status:

Signing status 
No errors have been found.

List of activated apps:

App list 
If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

The content of config/config.php:

Config report 
If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

or 

Insert your config.php content here
(Without the database password, passwordsalt and secret)

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: Chrome 56

Operating system: Any

Logs

Web server error log

Web server error log ``` Error index Error: Call to undefined function OCA\Theming\mime_content_type() ```

Nextcloud log (data/nextcloud.log)

Nextcloud log ``` Insert your Nextcloud log here ```

Browser log

Browser log ``` Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

</details>

Activity

  1. Zulgrib commented on Feb 6, 2017

    @Zulgrib
    Zulgrib
    on Feb 6, 2017
    Author

    If the user is in any group that isn't restricted, the user isn't restricted anymore, we should be able to do a shotgun approach where if the member is in a specific group, there is no possibilities at all to initiate a share with annyone, or we need a whitelist instead of blacklist.

  2. nickvergessen
    added
    enhancement
    feature: sharing
    on Feb 8, 2017

  3. aRandomKiwi commented on Apr 25, 2018

    @aRandomKiwi
    aRandomKiwi
    on Apr 25, 2018

    Hi @Zulgrib ,

    We solved this "issue" (depending of your case its best to deal with whitelist instead of NC's kind of blacklist which impose all groups of an user to match to revoke his share right), by editing "lib/private/Share20/Manager.php" and in the function "sharingDisabledForUser" definition replace

    if (!empty($usersGroups)) {
$remainingGroups = array_diff($usersGroups, $excludedGroups);
                                // if the user is only in groups which are disabled for sharing then
                                // sharing is also disabled for the user
                              if (empty($remainingGroups)) {
                                        $this->sharingDisabledForUsersCache[$userId] = true;
                                        return true;
                                }
                        }
   }

                $this->sharingDisabledForUsersCache[$userId] =false;
                return false;

    by :

           if (!empty($usersGroups)) {
                                //cherche si group dans excludedGroups (inversion)
                                for($i=0;$i!=sizeof($usersGroups);$i++){
                                        for($j=0;$j!=sizeof($excludedGroups);$j++){
                                                if($usersGroups[$i] == $excludedGroups[$j]){
                                                        $this->sharingDisabledForUsersCache[$userId] = false;
                                                        return false;
                                                }
                                        }
                                }
                                /*$remainingGroups = array_diff($usersGroups, $excludedGroups);
                                // if the user is only in groups which are disabled for sharing then
                                // sharing is also disabled for the user
                               if (empty($remainingGroups)) {
                                        $this->sharingDisabledForUsersCache[$userId] = true;
                                        return true;
                                }*/
                        }
                }

                $this->sharingDisabledForUsersCache[$userId] = true;
                return true;

    So you just need to put in the admin setting "groups excluded from sharing", the list of allowed groups, so every others groups cannot share.

    Note : We using a NC 13.0.1, but its the same code for NC 11 or 12, there is also a file "/lib/private/legacy/util.php" where there is a "isSharingDisabledForUser" function, not sure if needed to change it also because it work without do it.

  4. nextcloud-bot
    added
    staleTicket or PR with no recent activity
    on Jun 20, 2018
  5. skjnldsv
    added
    1. to developAccepted and waiting to be taken care of
    on Jun 12, 2019
  6. ghost removed
    staleTicket or PR with no recent activity
    on Jun 12, 2019

  7. herring-swe commented on Sep 2, 2019

    @herring-swe
    herring-swe
    on Sep 2, 2019

    If the user is in any group that isn't restricted, the user isn't restricted anymore, we should be able to do a shotgun approach where if the member is in a specific group, there is no possibilities at all to initiate a share with annyone, or we need a whitelist instead of blacklist.

    I agree with this. The current behavior is not intuitive and the exclude groups value needs to be updated as we add more users/groups instead of just having a "non-share" group.

  8. CoMPaTech commented on Dec 2, 2019

    @CoMPaTech
    CoMPaTech
    on Dec 2, 2019

    Just ran into this as well, expecting that sharing wouldn't be possible when a user is member of that group it doesn't work that way. I can appreciate the 'other way around', but this solicits for another box indeed - that way regression wouldn't be broken.

    A oneliner would be welcome as description, so for the existing functionality ("if user is only member of below groups, don't allow sharing:") - and adding a new functionality ("sharing is only allowed if member of (one or more of) these groups:". Where one could envision a simple toggle above that stating 'whitelist / blacklist'?

  9. hydro-test commented on Oct 20, 2020

    @hydro-test
    hydro-test
    on Oct 20, 2020

    It would be nice to add to this the ability to assign different groups to provide basic sharing and sharing by links.
    For example, if the user is a member of group-1, then he can share (except for sharing by links), if he is a member of group-2, then he can also share by links; and most importantly, regardless of membership in any other groups.

  10. joshtrichards
    added
    needs reviewNeeds review to determine if still applicable or covered by other Issues
    on Sep 23, 2024
  11. joshtrichards
    changed the title [-]Excluded groups can initiate shares[/-] [+]Users in groups excluded from sharing can initiate shares if also a member of a non-excluded group[/+] on Sep 23, 2024

  12. Detsieber commented on Oct 25, 2026

    @Detsieber
    Detsieber
    on Oct 25, 2026

    It looks like this issue has effectively been resolved recently, but wasn't closed.

    With #63828 (“fix(sharing): properly frame block list”), the block list logic was changed. A user who is a member of at least one excluded group can no longer initiate shares, even if they are also a member of a non-excluded group. That is exactly the behaviour requested here. The admin settings now say this explicitly:

    A member of at least one of these groups will not be able to initiate new shares, but will still be able to receive shares.

    The change was backported and shipped in:

    32.0.15 (#63932)
    33.0.9 (#63933)
    34.0.4 (#63934)
    35.0.0 (#63935)

    I can confirm the new behaviour on 33.0.10.

    Since #63828 doesn’t reference this issue, it wasn’t closed automatically. Could a maintainer please close it as resolved?

    One additional note: this is a behaviour change for existing configurations, but it shipped in patch releases labelled as a fix. It was not mentioned as a change in behaviour in the changelog or the admin documentation. In our case, a user in both an excluded and a non-excluded group silently lost the ability to share after a minor update. The fix itself is welcome, but admins relying on the old semantics may be caught off guard. The usual migration path is to switch to the allow list mode (“Limit sharing to some groups”), introduced in #34115 / NC 29. It might be worth adding an upgrade note to the admin manual’s file sharing page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    1. to developAccepted and waiting to be taken care ofenhancementfeature: sharingneeds reviewNeeds review to determine if still applicable or covered by other Issues

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions