Handling nested group folders access privileges when groups don't have access to parent folder

[pmarini-nc]

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.

When you give access to a group (or circle) to a nested groupfolder, users in that group cannot see the subfolder unless they manually create the parent folder(s).

Users don't know that and this creates some confusing renaming action if they are later granted access to the parent folder(s).

Describe the solution you'd like
I think that there are three possible expected behaviours:

• automatic parent folder(s) permission adjustment: apply the minimum set of permissions that allow the users in the group to access the subfolder they have been granted access to
• mount at root
• prevent the assignment of privileges to nested groupfolder when the group/circle doesn't have access to the parent groupfolder

To be discussed..

Describe alternatives you've considered

Additional context

[maximelehericy]

can't you make sure all the users having access to the nested groupfolder have access to the parent one ? e.g. granting access to "everyone" or large groups ?

[pmarini-nc]

Not sure I fully understand.. It is not feasible from a security stand-point to create a "everyone" group and grant it access to all the parents folder.

Let's say we want to give group2 access only to folder1-2

- folder1/
	confidential-file.txt    
	folder1-1/
  	folder1-2/

So, if I understand you correctly, we would put all the users in group1 also in group large-group and give large-group read-only access to folder1. By doing so the users in group1 would be able to see confidential-file.txt, that is not what we want.

Maybe the group folder admin can be also reasoning on using advanced ACL, but then he/she would need to manage more complex setups.

[XueSheng-GIT]

When you give access to a group (or circle) to a nested groupfolder, users in that group cannot see the subfolder unless they manually create the parent folder(s).

That's how I do it currently. Creating the folder structure manually so that users get access to such a subfolder. That's not and can lead to issues quite easily.

automatic parent folder(s) permission adjustment: apply the minimum set of permissions that allow the users in the group to access the subfolder they have been granted access to

That would be cool, but probably a bit of effort to adjust the code accordingly.

[provokateurin]

Fixed in nextcloud/server#47417