Server: Permission depends on the way of entering folders

[scroom]

Steps to reproduce

1. Create a folder with some subfolder
2. Share the top-folder with only read-access
3. Share the subfolder with write access
4. If users enter the subfolder directly out of their start-view, they can write to the subfolder, if they first open the top-folder and then the subfolder, they can't write to the folder

Expected behaviour

Allow the user to write even if they open the subfolder after the topfolder

Actual behaviour

see above

Server configuration

Operating system: Ubuntu 18.04

Web server: Nginx

Database: MySQL

PHP version: 7.2

Nextcloud version: 14.0.1

Updated from an older Nextcloud/ownCloud or fresh install: fresh

[nextcloud-bot]

GitMate.io thinks possibly related issues are https://github.com/nextcloud/server/issues/7588 (Folder permissions), https://github.com/nextcloud/server/issues/8479 (Simplify sharing permissions for folders), https://github.com/nextcloud/server/issues/11717 (NotPermittedException: No create permission for folder), https://github.com/nextcloud/server/issues/8931 (external folder can not be shared with delete permissions), and https://github.com/nextcloud/server/issues/2268 (Users can delete shared folders without permissions).

[violoncelloCH]

I would suggest to not allow a file/folder which is inside an already shared folder to be shared to the same recipient a second time. But it would be usefull to let the owner "upgrade" the permission for a subfolder/file.
What do you think @nextcloud/sharing @nextcloud/designers ?

[schlagi123]

I think this is an impotent feature to upgrade the permissions in a shared fordert, to create finer permissions. It could be created like ACLs in filesystems. This were a more flexible system for permissions.

[violoncelloCH]

As discussed with @juliushaertl a possible way of doing this could be to check for a (new) share if there already exists a parent share to the same recipient and then only upgrading the permissions for this folder/file (inside the parent share) instead of creating a new share which shows up in the recipients root. What do you think @rullzer @schiessle? Would this be possible?

[jancborchardt]

Is it necessary to rethink the way we do sharing? Wouldn’t it just be possible for Nextcloud to get "ah, now the person is in the subfolder, where they have write access to"?

Ideally nothing should change for people in the interface. This is a clear case of "it should just work as expected". :)

[violoncelloCH]

@jancborchardt yes, that's exactly the idea! The only thing to consider, I think, is if this shared subfolder should be visible in the recievers root directory (like a separate share) or not...?

[schiessle]

Is it necessary to rethink the way we do sharing? Wouldn’t it just be possible for Nextcloud to get "ah, now the person is in the subfolder, where they have write access to"?

Yes, it would be possible, and yes it would be rethinking the way sharing works today :wink:
But there are good chance that with Nextcloud 16 we will be able to solve it.

[guerby]

We've been hit by this issue on 18.0.4 as well, would be nice to have this fixed as it confuses our users and it took us some time to identify what was happening.

[guerby]

Note : when adding a tag to the file it seems nextcloud always choose the path through the shared directory and so no rights.