Delete File

[diogonunes95]

Hello! I recently created a folder where I shared with a group of users. In access, I removed all access to edit, create, update and remove.

So far so good. In other accounts, to access the folder, they can not do anything, except the part of remove. Even without access, they can remove the files that are inside the folder.

The version I have is the latest: ownCloud 7.0.4 (stable)

[DeepDiver1975]

Even without access, they can remove the files that are inside the folder.

Are you referring to the web interface or webdav or with one of our clients? THX

[diogonunes95]

Hi. The Web interface.

[DeepDiver1975]

Hi. The Web interface.

THX

[DeepDiver1975]

@nickvergessen @icewind1991 @VicDeo can I ask you to look into this? Affected versions to verify:
stable7 and master - THX

[diogonunes95]

@DeepDiver1975 , I forgot to mention that displays a message that can not be removed, however it removes.

[schiessle]

How did the users deleted the files in the folder? If delete permissions are removed the web interface doesn't show the "trash" for the delete operation at the right side of the file. (Just tried)

[DeepDiver1975]

How did the users deleted the files in the folder? If delete permissions are removed the web interface doesn't show the "trash" for the delete operation at the right side of the file. (Just tried)

I remember a case where the permissions got messed up (upgrade / missing permission propagation ???) and the trash icon did show up. In this case there is no permission check on the server which finally allows deletion. Maybe this is the case here as well ...

[schiessle]

In this case there is no permission check on the server which finally allows deletion. Maybe this is the case here as well ...

afaik OC\Filesystem checks permissions before we perform a operation but of course if the permissions are screwed up then this check will also get the wrong result.

Strange thing is that @diogonunes95 says that he gets a message telling him that the file can't be removed so at least some permission check seems to creates the correct result. Especially strange because at the back-end there is only one code-path to resolve the permissions for shares, so I don't see how we could get different results here.

[DeepDiver1975]

The only thing I remember (and this honestly sounds fishy): in the described scenario above the file could not be deleted via webdav but via the web - different code path are involved here for sure.

But finally - it's unclear is this is the same scenario

[diogonunes95]

@DeepDiver1975 , @schiesbn , I made a short video with the whole process and the problems I found

https://www.youtube.com/watch?v=RX6Zy9_0FzM&feature=youtu.be

[DeepDiver1975]

THX @diogonunes95 - the issue is related to the delete multiple feature

[dubsflyt]

not sure if related to this issue, but occationally files will (in the web interface) show up without the delete icon, sometimes just one or two in a folder of many. You can download and share these files fine, but not delete. To remove them they have to be manually deleted off the server filesystem.

[DeepDiver1975]

as far as I can tell this is fixed with 7.0.5 and OC8