After delete the user "avatars", the avatars for all users are deleted

[prsnbrg]

Steps to reproduce

1. Add the user "avatars" and log in with this user
2. Upload an avatar with another user
3. Delete the user "avatars"

Expected behaviour

Tell us what should happen
Delete all personal files from "avatar" user.

Actual behaviour

Tell us what happens instead
Delete the completly avatar directory with all avatars from other users.

Server configuration

Operating system:

Web server:

Database:

PHP version:

ownCloud version: (see ownCloud admin page)
10.0.6.1
Updated from an older ownCloud or fresh install:
Update from 10.0.4
Where did you install ownCloud from:
Web Installer and the update over the Shell

[phil-davis]

I will bet that doing this for any other "special" folder name will create similar havoc.
e.g. I have a files_external folder in my data folder, along with my admin user phil etc folders. I bet if I create a user called files_external there will be problems.

The namespace of the folder where the files for each user are stored should not be polluted with "special" folder names. But maybe it is too late to sort that out.

Ban those "special" names as user names?

[prsnbrg]

I have test this for the user files_external and i have the same problem, as the avatar user.

I think the best solution is a ban for the names avatar and files_external

[phil-davis]

And what other "special" folder names can "appear" in the data dir?

[hodyroff]

Ban does not help if we get the user in an external way aka LDAP?!

[phil-davis]

True
The ownCloud data directory typically holds all the "user data files" (i.e. everything that is not the code, and not a record in the database). So it needs to have folders for each type of "namespaced" files to be stored, and so if there are files that are not to be stored in the individual user's folder tree, then there needs to be separate folders for that stuff - e.g. avatars and files_external have been mentioned here.

So the per-user folder(s) need to go down a level:

data/avatars
data/files_external
data/other-files-that-have-to-go-somewhere
data/users
data/users/admin
data/users/phil
data/users/user1

a change like that would be a significant migration! But might not take long to run because it just moves the folder for each user down a level. (and has to be careful about the process if there is already a user called users !)

[butonic]

IMO users files should reside in data/files/
but since that would require moving a lot of files and if we were to follow up on that approach and move files_trashbin files to data/files_trashbin/ and files_versions to data/files_versions/ the backup of a user would become complicated.

I propose adding a data-apps folder that can be used to store app specific data, eg avatars, certificates, indexes ... basically if an app requests a server::getAppFolder() it will land in there.

[PVince81]

similar like #32547