Security Files Folder Delete Inside Check

Security: deleting or moving a folder in Files did not check what was inside it

Fixed in 5.4.0 · Found while reviewing PR #353 (the recycle bin) · Present in every release with Files, 3.4.0 to 5.3.0 · Module: Files

---

Timeline

Date	What happened
15 November 2026	Found while deciding what the new recycle bin should do with a deleted folder holding a subfolder its deleter could not see. Ed's question - "should we even allow the delete at all? crazy that someone could delete someone else's folder" - showed the delete itself was the problem.
15 November 2026	Fixed and released in 5.4.0, with the recycle bin. Commits and documentation described the new rule without saying older releases lacked it, until the release was out.
15 November 2026	This write-up published.

Upgrading to 5.4.0 is the fix.

The short version

In Files, permissions are set on folders, and a subfolder can stop inheriting so that it is kept from people who can open the folder above it.

What that could do. Deleting or moving a folder only checked that the person had Modify on that folder - not on what was inside. So someone with Modify on Projects could delete Projects - or move it somewhere else - even though it held HR, a subfolder that had been kept from them, and HR went with it.

What it could not do. It could not reveal anything: the person never saw HR, its name or its files. Deleting was a soft delete - nothing was destroyed, and the rows and stored files stayed in the database - but before 5.4.0 there was no screen to restore deleted items, so the folder's owner lost sight of it.

Who could do it: anyone with Modify on a folder holding a subfolder kept from them.

The fix

Deleting or moving a folder now needs Modify on the folder and on every folder inside it, however deep - as Windows does. The refusal names at most one folder, and only one the person can already see, so it cannot be used to discover the names of folders kept from them:

You cannot delete "Projects": it contains folders you do not have access to. Ask whoever manages this folder.

An administrator can see exactly what is in the way with System → Debug Tools → D020. How it works: Deleting or moving a folder - Developer Guide; the test (tests/files-folder-delete-refusal.php) includes a tree of 1,110 folders with one locked folder at the bottom.

If it happened on your install

A folder deleted this way is in the new recycle bin, and nothing has been lost:

• The owner of the hidden subfolder sees it in their recycle bin as Deleted along with a folder above it, and can Restore it on its own.
• The recycle bin's automatic clean-up never deletes a folder holding anything its deleter could not have deleted by hand. Administrators see any such folder in System → Maintenance → Deleted folders kept.

Related

• Files · Recycle bin - design · How the design evolved
• 5.4.0 release notes