[Bug]: Hide "new folder description" button on a upload only share link (file request link)

[julien21110]

⚠️ This issue respects the following points: ⚠️

• [x] This is a bug, not a question or a configuration/webserver/proxy issue.
• [x] This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• [x] Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• [x] I agree to follow Nextcloud's Code of Conduct.

Bug description

It seems this button appeared with nextcloud 31. With an upload only shared link, this button have no sense : the user cannot edit any readme file in a file request link. If the user clicks on this button, he fall in a no mans land. Moreover, if he try again clicking the button, he see the read me file (through a request file only link...)

Steps to reproduce

1. Be on nextcloud 31
2. Create a file request link / upload only public link
3. Click on the add folder description button

Expected behavior

Button not available with upload only link.

Nextcloud Server version

31

Operating system

RHEL/CentOS

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• [ ] Default user-backend (database)
• [x] LDAP/ Active Directory
• [ ] SSO - SAML
• [ ] Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[janbaum]

I had a look at this and have a question.

First, I could reproduce the issue as described. After once reproducing it, I don't get the "Add folder description" anymore but "Create new file". I couldn't figure out why. Cleared browser cache, deleted the created folder and created a new one, but since the first time repsoducing the issue, I only get "Create new file" 🤷

For the "Add folder description":

• click it
• see warning "Couldn't create file"
• see in the logged in account who owns the link, that README.md was actually created
• click the button again in request-link windows
• see multiple README($i).md be created in the acual folder, but can't be seen from request link.

For the "New text file" variant it's nearly the same, but:

• you get promted to set a file name
• don't get a warning that the file cant be created
• still can create multiple files in the original folder, without being able to see them from the request-link

Regardless of why the behaviour changed for me, I think this is an issue, that should be handled in the backend (other than #7788) since otherwise, by modifiying the frontend, one could still create unauthorized files, right?

[janbaum]

@mejo- For the frontend, as you said here, I thought I could add a check for some "upload_only" permissions. If I understand it correctly, those permissions are available in node_modules/@nextcloud/files/dist/permissions.d.ts:

export enum Permission {
    NONE = 0,
    CREATE = 4,
    READ = 1,
    UPDATE = 2,
    DELETE = 8,
    SHARE = 16,
    ALL = 31,
}

From the Browser console I can see, that when Request link is set in the sharing menu, permission is set to 4.

But wouldn't that also prevent the user from uploading files? Or is uploading != creation ?