collectives icon indicating copy to clipboard operation
collectives copied to clipboard

Block access to shares when sharing permissions are not met

Open mejo- opened this issue 2 years ago • 3 comments

Describe the bug Currently we don't check if sharing permissions are met when accessing a share. This should be changed.

To Reproduce Steps to reproduce the behavior:

  1. Add a share link as normal member
  2. Limit sharing to admins
  3. The share link from normal member still works

Expected behavior Limited sharing permissions should be considered when accessing a share link.

mejo- avatar Jul 19 '23 10:07 mejo-

Frankly... I'm not sure about this one. I understand the sharing permission as the permission to create a share at that point in time. If the user had the permission the share exists even if the permission is later revoked. We also do not revert edits done by a user that looses editing permissions. But maybe I don't fully understand the background here.

max-nextcloud avatar Dec 04 '23 20:12 max-nextcloud

Is the link share one individual per user or just one common per collective? In the first case I'd say it makes sense to revoke (same if the user looses access to the collective then).

juliusknorr avatar Dec 04 '23 21:12 juliusknorr

Is the link share one individual per user or just one common per collective? In the first case I'd say it makes sense to revoke (same if the user looses access to the collective then).

Exactly, it's a individual share link per user (just like share links work everywhere in Nextcloud). I agree that we should revoke share links from users with lower member level when bumping the level required for sharing permissions.

mejo- avatar Dec 05 '23 18:12 mejo-