user trying to delete personal folder results in deletion of EVERYTHING but his folder

[ghost]

Steps to reproduce

1. click delete folder
2. chose folder to delete
3. click ok

Expected behaviour

delete user's personnal folder

Actual behaviour

everything gets deleted

Server configuration

rhel 7.2

Web server:
apache 2.4

Database:
mysql

PHP version:
7

Teampass version:
latest release version 2 with manual #1551 fix

Updated from an older Teampass or fresh install:.
fresdh

Client configuration

all

Operating system:
all

[ghost]

I fear I need to give more information.

I I click my personal foler, then delete folder, then not opening the combo box and leave it as is, submiting will delete everything in the database.

Is I create a test folder, ad an entry, remove delete permissions form my user and redo the above, it still deletes the folder.

If I create a new folder, add an entry to it and make sure the user can only view and not delete (with roles), performing the above will delete everything again...

Same goes for hidden folders. They get deleted too even if the user HAS not a clue they even exist.

This is true with a local and ldap user. totally deactivated ldap to check...

[ghost]

this seems to be a duplicate of #1347

Why has a bug with such grave implications has not been solved yet?

[ghost]

More research...

If option to manage subfolders when ability to manage folder is enabled, this situation is present.

If removed option and create folder structure where user is able to manage 1 single folder in the tree, issue is present.

This is a major inconvenience.

[nilsteampassnet]

I discover this now.

And I confirm this bug.

I will provide a patch for this as soon as I can

[nilsteampassnet]

In file items.load.php

Search for

    if ($("#delete_rep_groupe").val() === "0") {
        $("#del_rep_show_error").html("<?php echo addslashes($LANG['error_group']);?>").show();>").show();
    } else if (confirm("<?php echo $LANG['confirm_delete_group'];?>")) {

replace by

    if ($("#delete_rep_groupe").val() === "0") {
        $("#del_rep_show_error").html("<?php echo addslashes($LANG['error_group']);?>").show();
    } else if ($("#delete_rep_groupe option:selected").text() === "<?php echo $_SESSION['login'];?>") {
        $("#del_rep_show_error").html("<?php echo addslashes($LANG['error_not_allowed_to']);?>").show();
    } else if (confirm("<?php echo $LANG['confirm_delete_group'];?>")) {

And In file sources/folder.queries.php

Search for

        case "delete_folder":
            // Check KEY and rights
            if ($_POST['key'] != $_SESSION['key'] || $_SESSION['user_read_only'] == true) {
                echo prepareExchangedData(array("error" => "ERR_KEY_NOT_CORRECT"), "encode");
                break;
            }
            $foldersDeleted = "";
            $folderForDel = array();
            // this will delete all sub folders and items associated

replace by

        case "delete_folder":
            // Check KEY and rights
            if ($_POST['key'] != $_SESSION['key'] || $_SESSION['user_read_only'] == true) {
                echo prepareExchangedData(array("error" => "ERR_KEY_NOT_CORRECT"), "encode");
                break;
            }

            // user shall not delete personal folder
            $data = DB::queryfirstrow(
                "SELECT personal_folder
                FROM ".prefix_table("nested_tree")." 
                WHERE id = %i",
                $_POST['id']
            );
            if ($data['personal_folder'] === "1") {
                echo prepareExchangedData(array("error" => "ERR_FOLDER_NOT_ALLOWED"), "encode");
                break;
            }

            // this will delete all sub folders and items associated
            $foldersDeleted = "";
            $folderForDel = array();