User in multiple groups only sees shares of one of the groups

[willmackay]

Describe the bug

A user who belongs to multiple groups only has the permissions of a single one of these groups.

Steps to reproduce

Steps to reproduce the behavior:

1. I created two groups (KFQwWJSl and xZjCGDhi).

2. As the admin user, I created a new folder (AmUZWyXITXUqwBzQ) and shared it with the first group (KFQwWJSl ).

3. I created a new user (ePxUovIhybXazegI) and added them to both groups.

4. I logged out and logged back in, and the new user (ePxUovIhybXazegI) does not see the folder (AmUZWyXITXUqwBzQ).

5. I logged back in as admin and removed the user from the second group (xZjCGDhi).

6. I logged back in as the new user and now I can see the share.

Expected behavior

The user should have seen the shared folder while in both groups.

Actual behavior

No share was visible.

Setup

I'm running ocis 2.0.0-beta8 on Debian 11, no containers.

PROXY_HTTP_ADDR=127.0.0.1:9200
OCIS_URL=https://ocis.alyrica.net
OCIS_BASE_DATA_PATH=/var/lib/ocis
OCIS_LOG_PRETTY=true

[willmackay]

Here's some screenshots of the bug

[phil-davis]

@saw-jan @amrita-shrestha please get someone to try and find a test scenario that checks access to shares for a user who is a member of multiple groups. If there is no automated test scenario, then create one - it should go in the core test suites, because we want to also verify that this works properly in oC10 core.

And then report if this is a problem with the oCIS back-end or with web.

[SagarGi]

@phil-davis i treid the above mentioned issue in latest docker image, building locally latest master ocis, and also tried checking out to ocis 2.0.0-beta8.

Latest Docker : Could not reproduce (may be fixed)
Latest master ocis : Could not reproduce (may be fixed)
ocis 2.0.0-beta8: Yes reproducable.

I will be adding up acceptance tests for this on core.

[SagarGi]

The above following acceptance has been added so moving this to Done.

[butonic]

@SagarGi hm I can reproduce this with ocis master and the demo accounts. create two folders with admin, share one with polonium-lovers, the other with physics-lovers. than marie will only see one share in the list of available shares.

[butonic]

found the bug. in https://github.com/cs3org/reva/blob/edge/pkg/share/manager/jsoncs3/jsoncs3.go#L719-L729 we are overwriting the previous result.

fix incoming

[micbar]

@willmackay the fix will be in ocis master after the next reva update.

[rhafer]

Fixed