Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Public link resharing permissions #4061

Closed
fschade opened this issue Jun 29, 2022 · 3 comments
Closed

Public link resharing permissions #4061

fschade opened this issue Jun 29, 2022 · 3 comments
Assignees
Labels

Comments

@fschade
Copy link
Contributor

fschade commented Jun 29, 2022

Describe the bug

a user is able to create a public link as an editor even if he only has viewer permissions for the incoming share

Steps to reproduce

  1. user a shares a resource to user b as viewer
  2. user b creates a public link of the share with editor permissions

Expected behaviour

the backend does not allow to create public links with higher permissions then the user has

Current behaviour

the backend allows the creation

@phil-davis
Copy link
Contributor

Similar to #3881

https://github.com/owncloud/ocis/blob/master/tests/acceptance/expected-failures-API-on-OCIS-storage.md has:

#### [Increasing permission of a public link of a folder that was initially shared with share+read permissions is allowed](https://github.com/owncloud/ocis/issues/3881)

- [apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature:159](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature#L159)
- [apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature:160](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature#L160)
- [apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature:181](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature#L181)
- [apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature:182](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSharePublicLink2/reShareAsPublicLinkToSharesNewDav.feature#L182)

There are failing API tests that cover this problem.

@micbar
Copy link
Contributor

micbar commented Jun 29, 2022

duplicate of #3881 which has already a P2 and is on the board

@kobergj
Copy link
Collaborator

kobergj commented Jul 14, 2022

cs3org/reva#3023

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Archived in project
Development

No branches or pull requests

4 participants