New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Bug]: Name collision of shared folders #34015
Comments
|
If you believe, that something is a "major digital security risk", please report it to https://hackerone.com/nextcloud. |
|
Currently running into the same problem. This needs to be fixed. |
|
@kesselb Could you try what happens when one sending user shares a subfolder with the same name to the same receiving user (e.g |
|
I shared |
|
I can confirm the issue: An external folder named Photos, which is accessible by Alice and Bob. The structure is:
My workaround was, that Charly renames the first shared folder to Best-Holiday_1. Afterwards he can get the next share. I would also call it a possible security issue. Maybe it only happens on external shares? |
|
Hi, Current status is that we don't know how to reproduce. If you observed something helpful, please let us know. |
|
I can reproduce this as well. My installation is running the Nextcloud AIO (24.0.7) image with standard configurations, with the only exception being that the 'Shared' folder has a different default name. When one account shares a folder with a certain group, and another account shares a folder with the same name to the same group, the entire group will only see the new folder. That is to say, there are no suffixes added to either folder, it simply shows the most recent share. |
|
Having the same issue here, on a new Docker deployment of |
|
Thanks for your input I will forward it accordingly. |
|
This was solved in 25.0.3 and the matching 24 version |


Bug description
When two or more (sending) users share a folder with the same (receiving) user, that receiving user will only see the folder of the latest (sending) user under the "shared" folder, without necessarily being aware of it. The other folders will only reappear if the receiving user renames the folder seen.
The issue was originally raised at https://help.nextcloud.com/t/shared-folder-with-same-name-starts-override-each-other-at-recipient-view/142574/3.
IMHO this is a critical bug, which could pose a major digital security risk that could be exploited to inject malicious files in another user's folder.
But irrespective of this, users that share their (default) folders should not have to worry about name collisions.
Steps to reproduce
1.Alice shares her "Document" folder with Charly => Charly sees Alice's "Document" folder
2.Bob shares his "Document" folder with Charly => Charly only sees Bob's "Document" folder.
3.Mallory shares his "Document" folder, which contains malware with Charly => Charly only sees Mallory's "Document" folder and may believe this is still Alice's Document folder.
Expected behavior
Charly should see all three folders: Alice's, Bob's and Mallory's "Document" folders, which may be renamed as "Document (Alice)", "Document (Bob)" and "Document (Mallory)" respectively.
Installation method
Community Docker image
Operating system
Fedora 36
PHP engine version
PHP 8.0
Web server
Apache (supported)
Database engine version
PostgreSQL
Is this bug present after an update or on a fresh install?
Fresh Nextcloud Server install
Are you using the Nextcloud Server Encryption module?
Encryption is Enabled
What user-backends are you using?
Configuration report
{ "system": { "memcache.local": "\\OC\\Memcache\\APCu", "apps_paths": [ { "path": "\/var\/www\/html\/apps", "url": "\/apps", "writable": false }, { "path": "\/var\/www\/html\/custom_apps", "url": "\/custom_apps", "writable": true } ], "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "password": "***REMOVED SENSITIVE VALUE***", "port": 6379 }, "overwritehost": "***REMOVED SENSITIVE VALUE***", "overwriteprotocol": "https", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "localhost", "***REMOVED SENSITIVE VALUE***" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "pgsql", "version": "24.0.4.1", "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "loglevel": "2", "log_type": "file", "logfile": "\/var\/www\/html\/data\/nextcloud.log", "log_rotate_size": "10485760", "log.condition": { "apps": [ "admin_audit" ] }, "preview_max_x": "2048", "preview_max_y": "2048", "jpeg_quality": "60", "enabledPreviewProviders": { "1": "OC\\Preview\\Image", "2": "OC\\Preview\\MarkDown", "3": "OC\\Preview\\MP3", "4": "OC\\Preview\\TXT", "5": "OC\\Preview\\OpenDocument", "6": "OC\\Preview\\Movie" }, "enable_previews": true, "upgrade.disable-web": true, "mail_smtpmode": "smtp", "trashbin_retention_obligation": "auto, 30", "versions_retention_obligation": "auto, 30", "activity_expire_days": "30", "simpleSignUpLink.shown": false, "share_folder": "\/Shared", "one-click-instance": true, "one-click-instance.user-limit": 100, "htaccess.RewriteBase": "\/", "files_external_allow_create_new_local": false, "trusted_proxies": "***REMOVED SENSITIVE VALUE***" } }List of activated Apps
Nextcloud Signing status
No response
Nextcloud Logs
No response
Additional info
No response
The text was updated successfully, but these errors were encountered: