Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ACL): Add check to prevent users from revoking their own access #2960

Merged
merged 1 commit into from
Feb 7, 2025

Conversation

icewind1991
Copy link
Member

@icewind1991 icewind1991 commented May 14, 2024

When changing ACL rules, check if the new rule set would lead the current user without read permissions

  • make the UI properly handle the error
  • (maybe) add an option to force revoking the access anyway

@icewind1991 icewind1991 added the 2. developing Items that are currently under development label May 14, 2024
Copy link
Member

@jancborchardt jancborchardt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@icewind1991 since you said

Would it maybe make more sense to just fully prevent users from revoking their own access?

I would say the modal is better, because maybe you do want to get out of the group folder?

Access removal
Proceeding will remove your own access to this group folder.
[ Cancel ] [ Remove own access ]

@provokateurin
Copy link
Member

Fixes #2822

@provokateurin
Copy link
Member

I would say the modal is better, because maybe you do want to get out of the group folder?

I don't think this makes sense, since in fact you do not remove yourself from the Team folder this way.
If the user no longer wants access, then an admin has to remove their access and they can not do it themselves through ACL (which also only works on sub folders, not the root Team folder itself anyway).

@provokateurin provokateurin added enhancement 3. to review Items that need to be reviewed and removed 2. developing Items that are currently under development labels Feb 3, 2025
@provokateurin provokateurin marked this pull request as ready for review February 3, 2025 12:13
@provokateurin provokateurin changed the title add check to prevent users from revoking their own access fix(ACL): Add check to prevent users from revoking their own access Feb 3, 2025
@provokateurin provokateurin merged commit af63689 into master Feb 7, 2025
50 checks passed
@provokateurin provokateurin deleted the prevent-revoke-self branch February 7, 2025 08:35
@provokateurin
Copy link
Member

/backport to stable31

@Jerome-Herbinet
Copy link
Member

Hi, awesome improvement ! Can't it be backported to some previous major releases @icewind1991 @jancborchardt ?

@provokateurin
Copy link
Member

Let's try!

@provokateurin
Copy link
Member

/backport to stable30

@provokateurin
Copy link
Member

/backport to stable29

@provokateurin
Copy link
Member

@Jerome-Herbinet stable30 was relatively easy to do, but stable29 unfortunately would need a larger amount of work, so not backporting it there.

@Jerome-Herbinet
Copy link
Member

Jerome-Herbinet commented Mar 5, 2025

@Jerome-Herbinet stable30 was relatively easy to do, but stable29 unfortunately would need a larger amount of work, so not backporting it there.

Thanks for your answer @provokateurin. Can you tell me when the next version of Team Folders for Nextcloud 30 (> 18.1.0) will be released (the version that will include this new backported feature)? and what precise version number ? I assume : 18.1.1 ?

@provokateurin
Copy link
Member

I can do it next Monday, should be 18.1.1 indeed.

@Jerome-Herbinet
Copy link
Member

I can do it next Monday, should be 18.1.1 indeed.

It would be great @provokateurin ! I'm currently making (and scheduling) a communication talking about this for next Tuesday (on Arawa's Mastodon, BlueSky and LinkedIn pages).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Items that need to be reviewed enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants