Create Share API not honoring "permissions" parameter #17504

asadsnowman · 2019-10-10T13:25:56Z

Steps to reproduce

Create a new Share on a folder through the API with the following parameters: shareType=3, publicUpload=true, and permissions=4.
Check new Share permissions in browser or through API.

Expected behaviour

Share permissions should be 4: "File drop (upload only)"

Actual behaviour

Share permissions are 15: "Allow upload and editing"

Server configuration

Operating system:
Ubuntu 18.04.1
Web server:
Apache/2.4.38 (Debian)
Database:
sqlite3 3.28.0
PHP version:
7.3.10
Nextcloud version:
17.0.0.9

Updated from an older Nextcloud/ownCloud or fresh install:
fresh install
Where did you install Nextcloud from:
docker
Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:
  - accessibility: 1.3.0
  - activity: 2.10.1
  - admin_audit: 1.7.0
  - cloud_federation_api: 1.0.0
  - comments: 1.7.0
  - dav: 1.13.0
  - federatedfilesharing: 1.7.0
  - federation: 1.7.0
  - files: 1.12.0
  - files_accesscontrol: 1.7.0
  - files_external: 1.8.0
  - files_pdfviewer: 1.6.0
  - files_rightclick: 0.14.2
  - files_sharing: 1.9.0
  - files_trashbin: 1.7.0
  - files_versions: 1.10.0
  - files_videoplayer: 1.6.0
  - firstrunwizard: 2.6.0
  - gallery: 18.4.0
  - group_everyone: 0.1.3
  - logreader: 2.2.0
  - lookup_server_connector: 1.5.0
  - nextcloud_announcements: 1.6.0
  - notifications: 2.5.0
  - oauth2: 1.5.0
  - password_policy: 1.7.0
  - privacy: 1.1.0
  - provisioning_api: 1.7.0
  - recommendations: 0.5.0
  - serverinfo: 1.7.0
  - sharebymail: 1.7.0
  - sharepoint: 1.5.0
  - support: 1.0.1
  - survey_client: 1.5.0
  - systemtags: 1.7.0
  - text: 1.1.0
  - theming: 1.8.0
  - twofactor_backupcodes: 1.6.0
  - updatenotification: 1.7.0
  - user_ldap: 1.7.0
  - viewer: 1.1.0
  - workflowengine: 1.7.0
Disabled:
  - encryption

Nextcloud configuration:

Config report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost:9999",
            "10.1.11.166:9999"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "sqlite3",
        "version": "17.0.0.9",
        "overwrite.cli.url": "http:\/\/localhost:9999",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_smtpmode": "smtp",
        "mail_smtpauth": 1,
        "mail_sendmailmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN"
    }
}

Are you using external storage, if yes which one: No

Are you using encryption: No

Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this part if not used)

LDAP config

+-------------------------------+----------------------------------------------------+
| Configuration                 | s01                                                |
+-------------------------------+----------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                  |
| homeFolderNamingRule          |                                                    |
| lastJpegPhotoLookup           | 0                                                  |
| ldapAgentName                 |REMOVED         |
| ldapAgentPassword             | ***                                                |
| ldapAttributesForGroupSearch  |                                                    |
| ldapAttributesForUserSearch   |                                                    |
| ldapBackupHost                |                                                    |
| ldapBackupPort                |                                                    |
| ldapBase                      | REMOVED                                  |
| ldapBaseGroups                | REMOVED                                  |
| ldapBaseUsers                 |REMOVED                                  |
| ldapCacheTTL                  | 600                                                |
| ldapConfigurationActive       | 1                                                  |
| ldapDefaultPPolicyDN          |                                                    |
| ldapDynamicGroupMemberURL     |                                                    |
| ldapEmailAttribute            | mail                                               |
| ldapExperiencedAdmin          | 0                                                  |
| ldapExpertUUIDGroupAttr       |                                                    |
| ldapExpertUUIDUserAttr        |                                                    |
| ldapExpertUsernameAttr        | samaccountname                                     |
| ldapExtStorageHomeAttribute   |                                                    |
| ldapGidNumber                 | gidNumber                                          |
| ldapGroupDisplayName          | cn                                                 |
| ldapGroupFilter               |                                                    |
| ldapGroupFilterGroups         |                                                    |
| ldapGroupFilterMode           | 0                                                  |
| ldapGroupFilterObjectclass    |                                                    |
| ldapGroupMemberAssocAttr      | member                                             |
| ldapHost                      | REMOVED                                         |
| ldapIgnoreNamingRules         |                                                    |
| ldapLoginFilter               | (&(&(|(objectclass=person)))(samaccountname=%uid)) |
| ldapLoginFilterAttributes     |                                                    |
| ldapLoginFilterEmail          | 0                                                  |
| ldapLoginFilterMode           | 0                                                  |
| ldapLoginFilterUsername       | 1                                                  |
| ldapNestedGroups              | 0                                                  |
| ldapOverrideMainServer        |                                                    |
| ldapPagingSize                | 500                                                |
| ldapPort                      | 389                                                |
| ldapQuotaAttribute            |                                                    |
| ldapQuotaDefault              |                                                    |
| ldapTLS                       | 0                                                  |
| ldapUserAvatarRule            | default                                            |
| ldapUserDisplayName           | displayname                                        |
| ldapUserDisplayName2          | samaccountname                                     |
| ldapUserFilter                | (&(!(objectclass=computer))(objectclass=person))   |
| ldapUserFilterGroups          |                                                    |
| ldapUserFilterMode            | 1                                                  |
| ldapUserFilterObjectclass     | person                                             |
| ldapUuidGroupAttribute        | auto                                               |
| ldapUuidUserAttribute         | auto                                               |
| turnOffCertCheck              | 0                                                  |
| turnOnPasswordChange          | 0                                                  |
| useMemberOfToDetectMembership | 1                                                  |
+-------------------------------+----------------------------------------------------+

Client configuration

Browser:
Google Chrome 77.0.3865.90 (Official Build) (64-bit)
Operating system:
Windows 10 OS Version 1809 (Build 17763.678)

Logs

Web server error log

Insert your webserver log here

Nextcloud log (data/nextcloud.log)

Nextcloud log

No errors reported in log for this issue

Browser log

Browser not required to recreate issue

The text was updated successfully, but these errors were encountered:

bpcurse · 2020-02-12T18:15:42Z

I can confirm this behavior for 16.0.7 and 18.0.1 RC2.

Possible workaround using HTTP PUT afterwards:
https://help.nextcloud.com/t/auto-create-public-and-drop-shares-for-each-user/70445/18

skjnldsv · 2021-03-22T08:35:56Z

Expected behaviour

Share permissions should be 4: "File drop (upload only)"

Actual behaviour

Share permissions are 15: "Allow upload and editing"

Not really

server/apps/files_sharing/lib/Controller/ShareAPIController.php

Lines 538 to 541 in f998769

    
           $permissions = Constants::PERMISSION_READ | 
        
           	Constants::PERMISSION_CREATE | 
        
           	Constants::PERMISSION_UPDATE | 
        
           	Constants::PERMISSION_DELETE;

If you want to be allowed to drop files, you need PERMISSION_CREATE. And any link share always have the PERMISSION_READ too. So if you give permissions:4, it will at least require 5.

Nonetheless, a proper file drop does not require PERMISSION_UPDATE nor PERMISSION_DELETE.

Manually changing the permissions to 4 afterwards works AND return 4, meaning we don't check the READ anymore 🤔

@rullzer @MorrisJobke what is this about the READ permissions, should we allow file drop without PERMISSION_READ ?
We should definitely fix the createShare api method then :)

tobiasKaminsky · 2023-01-23T07:33:23Z

Corresponding PR is not yet merged, so this cannot work yet.

joshtrichards · 2024-08-19T21:30:18Z

Very related open Issues:

There have been a couple of changes in behavior in between this issue and the above. Main ones:

My guess is, since this has come up a couple times, we also should do up a doc clarification:

https://docs.nextcloud.com/server/latest/developer_manual/client_apis/OCS/ocs-share-api.html#create-a-new-share

skjnldsv added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug feature: sharing labels Dec 9, 2019

bpcurse mentioned this issue Feb 13, 2020

Upload Issue on shared Folder nextcloud/groupfolders#486

Closed

skjnldsv added 1. to develop Accepted and waiting to be taken care of and removed 0. Needs triage Pending check for reproducibility or if it fits our roadmap labels Mar 22, 2021

julien-nc mentioned this issue Oct 8, 2021

Fix create share API permissions for links #29143

Closed

This comment was marked as resolved.

Sign in to view

szaimen added needs info 0. Needs triage Pending check for reproducibility or if it fits our roadmap and removed 1. to develop Accepted and waiting to be taken care of labels Jan 9, 2023

szaimen added 26-feedback and removed needs info labels Jan 23, 2023

This was referenced Aug 19, 2024

[Bug]: Share API default to wrong permissions #37774

Closed

[Bug]: sharing permissions set via API are incorrect #44782

Closed

susnux marked this as a duplicate of #37774 Jan 20, 2025

susnux marked this as a duplicate of #44782 Jan 20, 2025

susnux added 1. to develop Accepted and waiting to be taken care of and removed 0. Needs triage Pending check for reproducibility or if it fits our roadmap 26-feedback labels Jan 20, 2025

susnux added this to 📁 Files team Jan 20, 2025

susnux moved this to 🏗️ In progress in 📁 Files team Jan 20, 2025

susnux added this to the Nextcloud 31 milestone Jan 20, 2025

susnux self-assigned this Jan 20, 2025

susnux linked a pull request Jan 20, 2025 that will close this issue

fix(files_sharing): Respect permissions passed when creating link shares #50270

Open

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create Share API not honoring "permissions" parameter #17504

Create Share API not honoring "permissions" parameter #17504

asadsnowman commented Oct 10, 2019 •

edited by joshtrichards

Loading

bpcurse commented Feb 12, 2020 •

edited

Loading

skjnldsv commented Mar 22, 2021 •

edited by joshtrichards

Loading

Expected behaviour

Actual behaviour

This comment was marked as resolved.

tobiasKaminsky commented Jan 23, 2023

joshtrichards commented Aug 19, 2024

Create Share API not honoring "permissions" parameter #17504

Create Share API not honoring "permissions" parameter #17504

Comments

asadsnowman commented Oct 10, 2019 • edited by joshtrichards Loading

Steps to reproduce

Expected behaviour

Actual behaviour

Server configuration

LDAP configuration (delete this part if not used)

Client configuration

Logs

Web server error log

Nextcloud log (data/nextcloud.log)

Browser log

bpcurse commented Feb 12, 2020 • edited Loading

skjnldsv commented Mar 22, 2021 • edited by joshtrichards Loading

Expected behaviour

Actual behaviour

This comment was marked as resolved.

tobiasKaminsky commented Jan 23, 2023

joshtrichards commented Aug 19, 2024

asadsnowman commented Oct 10, 2019 •

edited by joshtrichards

Loading

bpcurse commented Feb 12, 2020 •

edited

Loading

skjnldsv commented Mar 22, 2021 •

edited by joshtrichards

Loading