fix: update re-share if shared-by user has been revoked #43025

luka-nextcloud · 2024-01-22T14:24:58Z

Resolves: [Bug]: Sub folder shares were broken on ownership transfer #42407

Summary

TODO

...

Checklist

Code is properly formatted
Sign-off message is added to all commits
Tests (unit, integration, api and/or acceptance) are included
Screenshots before/after for front-end changes
Documentation (manuals or wiki) has been updated or is not required
Backports requested where applicable (ex: critical bugfixes)

lib/private/Share20/Manager.php

luka-nextcloud · 2024-01-29T14:03:40Z

Another effected case by this issue:

UserA share Folder1 to UserB
UserB share Folder1 to UserC
UserA revoke UserB
UserA try to update sharing permission of UserC
-> Error: Could not get proper share mount for . Failing since else the next calls are called with null

luka-nextcloud · 2024-02-05T18:29:45Z

@artonge I've updated as you requested, please check again.

artonge

Can you add comments to clarify what each if group does?

I am also wondering if we could find this shares with the following query:

SELECT
	f.fileid,
	f.path,
	f.storage,
	s.id as share_id,
	s.uid_owner as share_owner,
	s.uid_initiator as share_initiator,
	s.share_with as share_recipient
FROM
	oc_filecache f
	JOIN oc_share s ON f.fileid = s.file_source
	AND s.uid_initiator NOT IN (
		SELECT
			user_id
		FROM
			oc_mounts m
		WHERE
			f.storage = m.storage_id
	)

If so, then we could have a background job to remove them every hour or so like https://github.com/nextcloud/server/blob/master/apps/files_sharing/lib/DeleteOrphanedSharesJob.php, which might be easier than the current solution.

lib/private/Share20/Manager.php

luka-nextcloud · 2024-02-06T19:08:25Z

Can you add comments to clarify what each if group does?

I am also wondering if we could find this shares with the following query:
SELECT
	f.fileid,
	f.path,
	f.storage,
	s.id as share_id,
	s.uid_owner as share_owner,
	s.uid_initiator as share_initiator,
	s.share_with as share_recipient
FROM
	oc_filecache f
	JOIN oc_share s ON f.fileid = s.file_source
	AND s.uid_initiator NOT IN (
		SELECT
			user_id
		FROM
			oc_mounts m
		WHERE
			f.storage = m.storage_id
	)
If so, then we could have a background job to remove them every hour or so like https://github.com/nextcloud/server/blob/master/apps/files_sharing/lib/DeleteOrphanedSharesJob.php, which might be easier than the current solution.

@artonge It only works if the shared-by user refreshes his files list after his share has revoked. So, I don't think this query would do the job.

apps/files_sharing/lib/Command/FixBrokenShares.php

apps/files_sharing/lib/OrphanHelper.php

apps/files_sharing/lib/Command/FixBrokenShares.php

apps/files_sharing/lib/OrphanHelper.php

apps/files_sharing/lib/Command/FixBrokenShares.php

lib/private/Share20/Manager.php

come-nc · 2024-06-10T13:24:45Z

Tests are failing

Signed-off-by: Luka Trovic <luka@nextcloud.com>

luka-nextcloud · 2024-06-17T18:12:27Z

@come-nc Could you please review again? All checks have passed now.

come-nc · 2024-06-20T14:39:05Z

apps/files_sharing/lib/OrphanHelper.php


 	public function __construct(
 		IDBConnection $connection,
-		IRootFolder $rootFolder
+		IRootFolder $rootFolder,
+		IUserMountCache $userMountCache


Suggested change

IUserMountCache $userMountCache

IUserMountCache $userMountCache,

come-nc · 2024-06-20T14:44:17Z

lib/private/Share20/Manager.php

+
+			foreach ($sharesInFolder as $shares) {
+				foreach ($shares as $child) {
+					$this->deleteShare($child);


For subfiles you did not check that the user still has access to it, I think?

come-nc · 2024-06-20T14:48:41Z

lib/private/Share20/Manager.php

+		// If the user has another shares, we don't delete the shares by this user
+		if ($share->getShareType() === IShare::TYPE_USER) {
+			$groupShares = $this->getSharedWith($share->getSharedWith(), IShare::TYPE_GROUP, $node, -1, 0);
+
+			if (count($groupShares) !== 0) {
+				return;
+			}
+
+			// Check shares of parent folders
+			try {
+				$parentNode = $node->getParent();
+				while ($parentNode) {
+					$groupShares = $this->getSharedWith($share->getSharedWith(), IShare::TYPE_GROUP, $parentNode, -1, 0);
+					$userShares = $this->getSharedWith($share->getSharedWith(), IShare::TYPE_USER, $parentNode, -1, 0);
+
+					if (count($groupShares) !== 0 || count($userShares) !== 0) {
+						return;
+					}
+
+					$parentNode = $parentNode->getParent();
+				}
+			} catch (NotFoundException) {
+			}
+		}


Instead of doing all this to check if the user still has access to the file or not, does it not make more sense to directly check if the user has access to the file? We must have some tooling for that, no?

@come-nc I cannot find another way to check this logic. Could you provide some suggestions?

Get the user folder of the user and use getFirstNodeById would work I think.

(Note that this would only work after deleting the share)

Signed-off-by: Luka Trovic <luka@nextcloud.com>

come-nc · 2024-06-24T15:30:26Z

@luka-nextcloud After talking with Robin, actually the ownership transfer is supposed to update the owner of the share so there should be no problem in the first place?

luka-nextcloud · 2024-06-24T17:30:38Z

@come-nc Does it mean that these changes are enough for this issue?

come-nc · 2024-06-25T08:37:10Z

@come-nc Does it mean that these changes are enough for this issue?

No, the second diff looks like it will cause trouble by arbitrary changing sharedBy of shares.

I lost track of what you are trying to fix, can you explain how to reproduce your problem? Why do you remove the exception handling removing invalid shares in OwnershipTransferService?

luka-nextcloud · 2024-06-25T14:27:36Z

@come-nc

Reproduce steps:

UserA share Folder1 to UserB
UserB share Folder1 to UserC
UserA deleted sharing to UserB
UserA transfer Folder1 to UserD
-> UserC lost access to Folder1. When UserC open sharing tab of Folder1, the error message Error: Could not get proper share mount for . Failing since else the next calls are called with null returned.

Issue occurred because the sharing of UserB to UserC was not deleted or updated after UserA deleted sharing to UserB. Then, when UserA transfering Folder1 to UserD, that re-share record cannot be transferred because it throws GenericShareException error.

come-nc · 2024-06-27T12:39:06Z

@come-nc

Reproduce steps:

UserA share Folder1 to UserB

UserB share Folder1 to UserC

UserA deleted sharing to UserB

UserA transfer Folder1 to UserD
-> UserC lost access to Folder1. When UserC open sharing tab of Folder1, the error message Error: Could not get proper share mount for . Failing since else the next calls are called with null returned.

Issue occurred because the sharing of UserB to UserC was not deleted or updated after UserA deleted sharing to UserB. Then, when UserA transfering Folder1 to UserD, that re-share record cannot be transferred because it throws GenericShareException error.

UserC already loses access to Folder1 after step 3, right?
At that point the sharing tab shows no error?

luka-nextcloud · 2024-06-27T14:54:45Z

@come-nc

UserC already loses access to Folder1 after step 3, right?

No, UserC didn't lose access to Folder1 after step3. This is the issue we are trying to fix.

At that point the sharing tab shows no error?

No error.

luka-nextcloud added bug 3. to review Waiting for reviews labels Jan 22, 2024

luka-nextcloud requested review from juliushaertl and artonge January 22, 2024 14:24

luka-nextcloud self-assigned this Jan 22, 2024

artonge reviewed Jan 22, 2024

View reviewed changes

lib/private/Share20/Manager.php Outdated Show resolved Hide resolved

luka-nextcloud force-pushed the bugfix/error-on-reshare-after-transfer-ownership branch 2 times, most recently from c298bf1 to 0828727 Compare February 5, 2024 18:28

luka-nextcloud requested a review from artonge February 5, 2024 18:28

artonge reviewed Feb 6, 2024

View reviewed changes

lib/private/Share20/Manager.php Outdated Show resolved Hide resolved

lib/private/Share20/Manager.php Show resolved Hide resolved

lib/private/Share20/Manager.php Outdated Show resolved Hide resolved

luka-nextcloud force-pushed the bugfix/error-on-reshare-after-transfer-ownership branch 3 times, most recently from 007d650 to df7160f Compare April 1, 2024 08:13

susnux added this to the Nextcloud 30 milestone Apr 18, 2024

luka-nextcloud force-pushed the bugfix/error-on-reshare-after-transfer-ownership branch from df7160f to 73fb85b Compare May 30, 2024 12:15

luka-nextcloud requested review from skjnldsv and come-nc as code owners May 30, 2024 12:15

github-advanced-security bot found potential problems May 30, 2024

View reviewed changes

apps/files_sharing/lib/Command/FixBrokenShares.php Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems May 31, 2024

View reviewed changes

apps/files_sharing/lib/Command/FixBrokenShares.php Fixed Show fixed Hide fixed

come-nc reviewed Jun 3, 2024

View reviewed changes

skjnldsv removed their request for review June 3, 2024 08:07

luka-nextcloud force-pushed the bugfix/error-on-reshare-after-transfer-ownership branch from 7e64905 to cf9b02a Compare June 4, 2024 18:39

luka-nextcloud requested review from artonge and come-nc June 4, 2024 18:40

github-advanced-security bot found potential problems Jun 4, 2024

View reviewed changes

apps/files_sharing/lib/Command/FixBrokenShares.php Fixed Show fixed Hide fixed

come-nc requested changes Jun 6, 2024

View reviewed changes

apps/files_sharing/lib/OrphanHelper.php Outdated Show resolved Hide resolved

apps/files_sharing/lib/Command/FixBrokenShares.php Outdated Show resolved Hide resolved

lib/private/Share20/Manager.php Outdated Show resolved Hide resolved

luka-nextcloud requested a review from come-nc June 7, 2024 13:46

luka-nextcloud force-pushed the bugfix/error-on-reshare-after-transfer-ownership branch 3 times, most recently from 323ffb4 to 0d42361 Compare June 17, 2024 08:23

feat: add command to fix broken shares after transfer ownership

032be69

Signed-off-by: Luka Trovic <luka@nextcloud.com>

luka-nextcloud force-pushed the bugfix/error-on-reshare-after-transfer-ownership branch from 0d42361 to 032be69 Compare June 17, 2024 15:11

come-nc reviewed Jun 20, 2024

View reviewed changes

fix: check if able to access subfiles or folders

a03da0a

Signed-off-by: Luka Trovic <luka@nextcloud.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: update re-share if shared-by user has been revoked #43025

fix: update re-share if shared-by user has been revoked #43025

luka-nextcloud commented Jan 22, 2024

luka-nextcloud commented Jan 29, 2024

luka-nextcloud commented Feb 5, 2024

artonge left a comment

luka-nextcloud commented Feb 6, 2024

come-nc commented Jun 10, 2024

luka-nextcloud commented Jun 17, 2024

come-nc Jun 20, 2024

come-nc Jun 20, 2024

come-nc Jun 20, 2024

luka-nextcloud Jun 21, 2024

come-nc Jun 24, 2024

come-nc Jun 24, 2024

come-nc commented Jun 24, 2024

luka-nextcloud commented Jun 24, 2024

come-nc commented Jun 25, 2024

luka-nextcloud commented Jun 25, 2024

come-nc commented Jun 27, 2024

luka-nextcloud commented Jun 27, 2024

	IUserMountCache $userMountCache
	IUserMountCache $userMountCache,

fix: update re-share if shared-by user has been revoked #43025

Are you sure you want to change the base?

fix: update re-share if shared-by user has been revoked #43025

Conversation

luka-nextcloud commented Jan 22, 2024

Summary

TODO

Checklist

luka-nextcloud commented Jan 29, 2024

luka-nextcloud commented Feb 5, 2024

artonge left a comment

Choose a reason for hiding this comment

luka-nextcloud commented Feb 6, 2024

come-nc commented Jun 10, 2024

luka-nextcloud commented Jun 17, 2024

come-nc Jun 20, 2024

Choose a reason for hiding this comment

come-nc Jun 20, 2024

Choose a reason for hiding this comment

come-nc Jun 20, 2024

Choose a reason for hiding this comment

luka-nextcloud Jun 21, 2024

Choose a reason for hiding this comment

come-nc Jun 24, 2024

Choose a reason for hiding this comment

come-nc Jun 24, 2024

Choose a reason for hiding this comment

come-nc commented Jun 24, 2024

luka-nextcloud commented Jun 24, 2024

come-nc commented Jun 25, 2024

luka-nextcloud commented Jun 25, 2024

come-nc commented Jun 27, 2024

luka-nextcloud commented Jun 27, 2024