Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(trash): Fix deleting items from public share with write access #3604

Merged
merged 1 commit into from
Feb 17, 2025

Conversation

come-nc
Copy link
Contributor

@come-nc come-nc commented Feb 11, 2025

When no user in session, default to owner.

Fix #3544 hopefully.

@come-nc come-nc added the 3. to review Items that need to be reviewed label Feb 11, 2025
@come-nc come-nc self-assigned this Feb 11, 2025
Copy link

@kyteinsky kyteinsky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💚 thanks

Copy link
Contributor

@artonge artonge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it makes sense. If an anonymous user deleted a file from a public share, then we should say so and not accuse the owner of the public share.
Maybe using a placeholder like "anonymous public user" would be better?

@come-nc
Copy link
Contributor Author

come-nc commented Feb 13, 2025

@kyteinsky Can you test the behavior when using '' instead of $owner?
It looks like the rest of the code considers deleted_by as optional.

@kyteinsky
Copy link

file_4 was deleted with '', file_5 with null
both have the same db state for deleted_by too

When no user in session, use an empty string as deleted_by, which shows
 as "Unknown" in the UI.

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
@come-nc come-nc force-pushed the fix/fix-move-to-trash-from-public-share branch from b293363 to 574c909 Compare February 13, 2025 13:55
@come-nc come-nc requested review from artonge and kyteinsky February 13, 2025 13:55
@come-nc
Copy link
Contributor Author

come-nc commented Feb 13, 2025

file_4 was deleted with '', file_5 with null both have the same db state for deleted_by too

The parameter is typed as string on groupfolders side, so I’m using ''.
I forced push a version using that instead of $owner.

@kyteinsky
Copy link

maybe we can also change the term "Unknown" to "Anonymous Public User" like @artonge suggested?
but it might affect deletions from a previous version where this field was not there and values are set to null by default on upgrade.
a third state may be useful here somehow: unknown, user and "anonymous".

Or "Unknown" is fine too.

@come-nc come-nc merged commit 880638b into master Feb 17, 2025
46 checks passed
@come-nc come-nc deleted the fix/fix-move-to-trash-from-public-share branch February 17, 2025 15:44
@kyteinsky
Copy link

/backport to stable31

@kyteinsky
Copy link

/backport to stable30

@kyteinsky
Copy link

/backport to stable29

Copy link

backportbot bot commented Feb 17, 2025

The backport to stable30 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable30
git pull origin stable30

# Create the new backport branch
git checkout -b backport/3604/stable30

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 574c909c

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/3604/stable30

Error: No changes found in backport branch


Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

Copy link

backportbot bot commented Feb 17, 2025

The backport to stable29 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable29
git pull origin stable29

# Create the new backport branch
git checkout -b backport/3604/stable29

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 574c909c

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/3604/stable29

Error: No changes found in backport branch


Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

@ReneFloitgraf
Copy link

I think the (new) fix still doesn't work!

Steps to reproduce:

  1. Share a folder within a groupfolder via link with rights to upload files.
  2. Use link in another browser and upload a file.
  3. Delete the uploaded file as a regular nextcloud-user.

The file will still not be removed until the app "deleted files" is deactivated!

Groupfolder - MoveToTrash - Error.log

@come-nc
Copy link
Contributor Author

come-nc commented Feb 24, 2025

I think the (new) fix still doesn't work!

Steps to reproduce:

  1. Share a folder within a groupfolder via link with rights to upload files.
  2. Use link in another browser and upload a file.
  3. Delete the uploaded file as a regular nextcloud-user.

The file will still not be removed until the app "deleted files" is deactivated!

Groupfolder - MoveToTrash - Error.log

This is specific to objectstore storage, and comes from #3481
I think the check is_callable is wrong, it only checks that the array looks like a callable, not that the method actually exists.
Can you open a new issue for this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Items that need to be reviewed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[bug]: Anonymous users cannot delete files in a publicly shared groupfolder
4 participants