v0.7.1 — security fix (settings privilege escalation)

Security fix — please update from 0.7.0.

The settings endpoints decided whether a request writes the instance wide defaults purely from a type=admin request parameter, which any logged-in account could send. A non-admin could therefore overwrite the admin defaults — most importantly default_sharing_folder, which controls what is served without a share and could be pointed at another account's folder to expose its contents.

Admin rights are now resolved through IGroupManager; a non-admin request for the defaults is rejected with 403 instead of silently falling back to the personal setting. This flaw is present in every upstream release (including the App Store version 0.4.4).

Verified on Nextcloud 33.0.6: attacker request returns 403 with the stored value unchanged; admin writes and personal writes both still work.

Two app ids

This release ships two tarballs built from the same code base:

Tarball	App id	URL
sharingpath-0.7.1.tar.gz	sharingpath	/apps/sharingpath/<user>/<path>
sharepath-0.7.1.tar.gz	sharepath	/apps/sharepath/<user>/<path>

They are functionally identical, carry separate PHP namespaces and can be installed side by side. See the README for which one to pick.

Install

tar xzf sharepath-0.7.1.tar.gz -C /path/to/nextcloud/custom_apps/
occ app:enable sharepath

Disclaimer

This fork's compatibility work was developed and tested with substantial assistance from an AI coding agent (Claude Code); review before use in critical environments. The software is provided as is without warranty of any kind — the authors and maintainers accept no liability for damages or unintended exposure of files (AGPL sections 15/16).