-
Notifications
You must be signed in to change notification settings - Fork 138
Description
Steps to reproduce
1.Create a file as user A
2.Share it with user B allowing edits
3.As user B open shared file and "Save As" a new filename (specifying no path)
4.The new file is created relative to Owner path and not editor's one, if the path is not also shared this means User B cannot find the file anywhere in NextCloud
Expected behaviour
For files shared "directly" (not because they're in a shared folder) either I'd expect that :
- the "save as" feature is disabled
or - if the path in which the "saved as" file is supposed to be stored is not also shared with the editor the save as operation fails
or - if the path in which the "saved as" file is supposed to be stored is not also shared with the editor the saving occours in an editor's folder and not in an owner's one
Actual behaviour
The new file is created relative to Owner path and not editor's one, if the path is not also shared this means User B cannot find the file anywhere in NextCloud.
Also this means the editor can in fact write in a path in which he hasn't any write permission granted
Server configuration detail
Operating system: Linux 3.16.38-xen #1 SMP Sat Oct 22 00:13:20 CEST 2016 x86_64
Webserver: Apache/2.4.20 (Unix) OpenSSL/1.0.2h PHP/5.6.23 (apache2handler)
Database: mysql 10.0.26
PHP version: 5.6.23
Modules loaded: Core, date, ereg, libxml, pcre, fileinfo, filter, hash, SPL, json, mcrypt, session, bz2, posix, Reflection, standard, SimpleXML, sockets, imap, sysvmsg, sysvsem, sysvshm, xml, xmlwriter, mysqlnd, apache2handler, bcmath, openssl, calendar, ctype, curl, dba, dom, enchant, mbstring, ftp, gd, gettext, gmp, iconv, intl, ldap, exif, mysql, mysqli, odbc, zlib, PDO, pdo_mysql, pdo_sqlite, PDO_ODBC, pspell, shmop, snmp, soap, sqlite3, tokenizer, wddx, xmlreader, xsl, zip, Phar, redis, Zend OPcache
Nextcloud version: 12.0.5 - 12.0.5.3