Skip to content

Comments

fix: Prefer mount owner over current user as owner of the storage#3538

Merged
juliusknorr merged 1 commit intomasterfrom
fix/storage-owner
Jan 16, 2025
Merged

fix: Prefer mount owner over current user as owner of the storage#3538
juliusknorr merged 1 commit intomasterfrom
fix/storage-owner

Conversation

@juliusknorr
Copy link
Member

@juliusknorr juliusknorr commented Jan 16, 2025

Fixes nextcloud/server#40090 (comment)

This pull request fixes an issue where the current user is wrongly assumed as the storage owner. This then may lead to the files_versions app not being able to store a version properly, ending up with a file that cannot be saved in a rather specific scenario:

Steps to reproduce:

  • user A has access to the group folder, creates a share link with write permission
  • user B has no access to the group folder and opens the share link, edits and tries to save with Collabora

I'm not sure if there is a case where this could also be triggered without collabora.

We set userB in richdocuments as the active user
https://github.com/nextcloud/richdocuments/blob/b4b76b4b326005eb469b13643bfe7e2d9fdcb580/lib/Controller/WopiController.php#L436

This then later on fails when files_versions tries to get path for the node:
https://github.com/nextcloud/server/blob/369274c9ee82eed6010a1a3b9cc5bac1a9926e2c/apps/files_versions/lib/Listener/FileEventsListener.php#L374-L383

For the mountpoint of a share we should still assume the mount owner as the storage owner instead of always taking the current user. Using the user from the session used to be the fallback for any storage that does have shared ownership, but we can be more specific here with the mount owner.

@juliusknorr
Copy link
Member Author

/backport to stable30

@juliusknorr
Copy link
Member Author

/backport to stable29

@juliusknorr juliusknorr merged commit 2b97330 into master Jan 16, 2025
44 checks passed
@juliusknorr juliusknorr deleted the fix/storage-owner branch January 16, 2025 15:52
@backportbot
Copy link

backportbot bot commented Jan 16, 2025

The backport to stable29 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable29
git pull origin stable29

# Create the new backport branch
git checkout -b backport/3538/stable29

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 3612926d

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/3538/stable29

Error: No changes found in backport branch


Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

@backportbot
Copy link

backportbot bot commented Jan 16, 2025

The backport to stable30 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable30
git pull origin stable30

# Create the new backport branch
git checkout -b backport/3538/stable30

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 3612926d

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/3538/stable30

Error: No changes found in backport branch


Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Items that need to be reviewed backport-request bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: basicOperation(): Argument #2 ($path) must be of type string, null given

3 participants