Flie access control : files upload and then denied (TransferId*.part present).

[tmartincpp]

Steps to reproduce

1. Enable "File access control" app
2. Add a rule with :

• File name
• matches
• /^.*.(jar|exe|cmd|bat)$/i

3. Add a something.exe file in the directory of your NextCloud Desktop client (2.5.2.5231)

Expected behaviour

I would have guess that the upload would be denied even before starting it (because of the .exe in the file name).

Actual behaviour

The file is denied once the upload is completed, leaving something.exe.ocTransferIdXXXXXXXXXX.part files on the server.

NextCloud Desktop seems to try to re-upload the file frequently (at least when it starts).
So my users are filling my server's disk without knowing it (as those files are not took into account in users quota).

I'm deleting those ocTransferId*.part files regularly but I feel like it would be nice if the upload would be denied without even starting (don't know if this is possible).

Server configuration

Operating system:
Debian 9.9 (Stretch)

Web server:
Nginx

Database:
MariaDB 10.1.38-0+deb9u1

PHP version:
7.0.33-0+deb9u3

Nextcloud version: (see Nextcloud admin page)
15.0.8

Updated from an older Nextcloud/ownCloud or fresh install:
Updated from 15.0.7 (first install was probably 15.0.6)

Where did you install Nextcloud from:
sources

Signing status:
Nothing relevant.

List of activated apps:

• accessibility: 1.1.0
• activity: 2.8.2
• admin_audit: 1.5.0
• announcementcenter: 3.4.1
• apporder: 0.6.0
• bookmarks: 1.0.8
• bruteforcesettings: 1.4.0
• calendar: 1.6.5
• cloud_federation_api: 0.1.0
• comments: 1.5.0
• dav: 1.8.2
• deck: 0.6.4
• event_update_notification: 0.3.4
• federatedfilesharing: 1.5.0
• files: 1.10.0
• files_accesscontrol: 1.5.0
• files_external: 1.6.0
• files_pdfviewer: 1.4.0
• files_rightclick: 0.13.0
• files_sharing: 1.7.0
• files_texteditor: 2.7.0
• files_trashbin: 1.5.0
• files_versions: 1.8.0
• files_videoplayer: 1.4.0
• gallery: 18.2.0
• impersonate: 1.2.0
• lookup_server_connector: 1.3.0
• notifications: 2.3.0
• oauth2: 1.3.0
• password_policy: 1.5.0
• polls: 0.10.2
• previewgenerator: 2.1.0
• provisioning_api: 1.5.0
• quicknotes: 0.1.7
• richdocuments: 3.3.14
• systemtags: 1.5.0
• tasks: 0.11.0
• theming: 1.6.0
• twofactor_backupcodes: 1.4.1
• user_ldap: 1.5.0
• workflowengine: 1.5.0

Nextcloud configuration:
{
"system": {
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"mydomain.com"
],
"datadirectory": "REMOVED SENSITIVE VALUE",
"dbtype": "mysql",
"version": "15.0.8.1",
"overwrite.cli.url": "https://mydomain.com",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true,
"instanceid": "REMOVED SENSITIVE VALUE",
"logfile": "/var/log/nextcloud.log",
"mysql.utf8mb4": true,
"maintenance": false,
"default_language": "en",
"default_locale": "fr_FR",
"allow_user_to_change_display_name": false,
"session_keepalive": true,
"auth.bruteforce.protection.enabled": true,
"has_internet_connection": false,
"appstoreenabled": false,
"upgrade.disable-web": false,
"debug": false,
"ldapIgnoreNamingRules": false,
"ldapProviderFactory": "OCA\User_LDAP\LDAPProviderFactory",
"mail_smtpmode": "smtp",
"mail_sendmailmode": "smtp",
"mail_from_address": "REMOVED SENSITIVE VALUE",
"mail_domain": "REMOVED SENSITIVE VALUE",
"mail_smtphost": "REMOVED SENSITIVE VALUE",
"mail_smtpport": "25",
"memcache.local": "\OC\Memcache\APCu",
"filelocking.enabled": true,
"memcache.locking": "\OC\Memcache\Redis",
"redis": {
"host": "REMOVED SENSITIVE VALUE",
"port": 6379,
"timeout": 0,
"password": "REMOVED SENSITIVE VALUE"
},
"skeletondirectory": "/nextcloud/custom_skeleton",
"loglevel": 2
}
}

Are you using external storage, if yes which one: local/smb/sftp/...
SFTP but not related to this issue.

Are you using encryption: yes/no
No

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
LDAP

LDAP configuration (delete this part if not used)

Not related to this issue AFAIK, not comfortable to make this public.

Logs

Web server error log

Nothing relevant.

Nextcloud log (data/nextcloud.log)

==> /var/log/nextcloud.log <==
{"reqId":"wqXHmxplprSFLrozqH51","level":4,"time":"2019-07-23T12:37:50+00:00","remoteAddr":"10.X.Y.Z","user":"myuser","app":"webdav","method":"PUT","url":"/remote.php/dav/files/myuser/test.exe","message":{"Exception":"OCA\DAV\Connector\Sabre\Exception\Forbidden","Message":"Access denied","Code":0,"Trace":[{"file":"/nextcloud/www/apps/dav/lib/Connector/Sabre/Directory.php","line":156,"function":"put","class":"OCA\DAV\Connector\Sabre\File","type":"->","args":[null]},{"file":"/nextcloud/www/3rdparty/sabre/dav/lib/DAV/Server.php","line":1096,"function":"createFile","class":"OCA\DAV\Connector\Sabre\Directory","type":"->","args":["test.exe",null]},{"file":"/nextcloud/www/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":525,"function":"createFile","class":"Sabre\DAV\Server","type":"->","args":["files/myuser/test.exe",null,null]},{"function":"httpPut","class":"Sabre\DAV\CorePlugin","type":"->","args":[{"absoluteUrl":"https://mydomain.com/remote.php/dav/files/myuser/test.exe","class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/nextcloud/www/3rdparty/sabre/event/lib/EventEmitterTrait.php","line":105,"function":"call_user_func_array","args":[[{"class":"Sabre\DAV\CorePlugin"},"httpPut"],[{"absoluteUrl":"https://mydomain.com/remote.php/dav/files/myuser/test.exe","class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]]},{"file":"/nextcloud/www/3rdparty/sabre/dav/lib/DAV/Server.php","line":479,"function":"emit","class":"Sabre\Event\EventEmitter","type":"->","args":["method:PUT",[{"absoluteUrl":"https://mydomain.com/remote.php/dav/files/myuser/test.exe","class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]]},{"file":"/nextcloud/www/3rdparty/sabre/dav/lib/DAV/Server.php","line":254,"function":"invokeMethod","class":"Sabre\DAV\Server","type":"->","args":[{"absoluteUrl":"https://mydomain.com/remote.php/dav/files/myuser/test.exe","class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/nextcloud/www/apps/dav/lib/Server.php","line":301,"function":"exec","class":"Sabre\DAV\Server","type":"->","args":[]},{"file":"/nextcloud/www/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\DAV\Server","type":"->","args":[]},{"file":"/nextcloud/www/remote.php","line":163,"args":["/nextcloud/www/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/nextcloud/www/apps/dav/lib/Connector/Sabre/File.php","Line":258,"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (Windows) mirall/2.5.2git (build 20190319) (Nextcloud)","version":"15.0.8.1"}

Thanks!

[kesselb]

Thank you for reporting this issue 👍

cc @nextcloud/server-triage server or https://github.com/nextcloud/files_accesscontrol?

[nickvergessen]

yeah, that is a known limitation of the current way the app works. but especially with chunking of the sync clients we can't trust the data the clients provide.

Maybe you can try to fiddle around in the code of
https://github.com/nextcloud/server/blob/master/apps/workflowengine/lib/Check/FileMimeType.php#L74

and remove the trailing ocTransfer suffix before detectPath() on the mimetype detector is used.

[tmartincpp]

Thanks for your feedbacks!

[Githopp192]

per chance i saw a lot of *.part files on my Nextcloud for a lot user users - they consume space.
Rescan folder (occ) did not make them disappear.

The files are from 2022, November - so - i'm not sure if the probem still exists ?

(NC 26.0.5, PHP 8.1, MariaDB, RHEL 8.9)

DONE - wrote a cleanup script to remove them all

[ZoXx]

DONE - wrote a cleanup script to remove them all

possible to get it? Got the same problem with an amount of round about 400gb files .....

[Githopp192]

cleanup_part_files.txt

@ZoXx - rename "cleanup_part_files.txt" to cleanup_part_files.sh

i run this script on production with many users.

but of course - i'm taking no repsonsibility for any damage - so please be adviced to run it before in a test enviromnent on your site (vm .. vbox).

[ZoXx]

cleanup_part_files.txt

@ZoXx - rename "cleanup_part_files.txt" to cleanup_part_files.sh

i run this script on production with many users.

but of course - i'm taking no repsonsibility for any damage - so please be adviced to run it before in a test enviromnent on your site (vm .. vbox).

i will try.
Thank you very much!!!