User can see files which he is not athirized to access

[Peffi]

Hello I am "only"admin, on a cloud service setup by provider.

Steps to reproduce

1. unauthorised User click recent files
2. files which he is not athirized to access
3. authorisation set by group folder

Expected behaviour

See only files files which he is athirized to access

Actual behaviour

Tell us what happens instead

Server configuration

version: 16.0.1.1 -
versionstring: 16.0.1

Enabled:

• accessibility: 1.2.0
• activity: 2.9.1
• calendar: 1.7.0
• cloud_federation_api: 0.2.0
• comments: 1.6.0 - dav: 1.9.2
• federatedfilesharing: 1.6.0
• federation: 1.6.0 - files: 1.11.0
• files_pdfviewer: 1.5.0
• files_rightclick: 0.13.0
• files_sharing: 1.8.0
• files_texteditor: 2.8.0
• files_trashbin: 1.6.0
• files_versions: 1.9.0
• files_videoplayer: 1.5.0
• firstrunwizard: 2.5.0
• gallery: 18.3.0
• groupfolders: 4.0.4
• logreader: 2.1.0
• lookup_server_connector: 1.4.0
• nextcloud_announcements: 1.5.0
• notifications: 2.4.1
• oauth2: 1.4.2
• occweb: 0.0.4
• onlyoffice: 2.4.0
• privacy: 1.0.0
• provisioning_api: 1.6.0
• serverinfo: 1.6.0
• sharebymail: 1.6.0
• systemtags: 1.6.0
• theming: 1.7.0
• twofactor_backupcodes: 1.5.0
• viewer: 1.0.0
• workflowengine: 1.6.0

Disabled:

• admin_audit
• contacts
• encryption
• files_external
• password_policy
• recommendations
• registration
• support
• survey_client
• updatenotification
• user_ldap

[kesselb]

For security related issues https://hackerone.com/nextcloud is the fastest way.

Would you mind to add some details about this? So there is a group folder with multiple folders and I'm allowed to access only one of them but see files from other folders in recent files?

cc @nextcloud/security 🚨

[Peffi]

Hello Daniel,

The folder structure is as follows:
Root: all users have access (4 groups A,B,C,D)
-Subfolder 1.0: 2 groups (A&B) have access (plus admin at the time being)
--Sub-Sub 1.1: 2 groups (A&B) have access (plus admin at the time being)
--Sub-Sub 1.2: 1 group (A) has access (plus admin at the time being)
-Subfolder 2.0: 2 groups (A&C) have access (plus admin at the time being)
-Subfolder 3.0: 2 groups (A&D) have access (plus admin at the time being)
-Subfolder 4.0: 1 group (A) havs access (plus admin at the time being)
-Subfolder 5.0: 1 group (D) havs access (plus admin at the time being)

I (group A) created files in Sub-Sub 1.2 and users from Group B+C can see the filename in "Recent",
but can't access the file (with error message)
As I am setting up the teams(s) server I only have 3 users belonging to group A,B,C and the others Subfolders behave similar.

I hope I have made myself clear and you understand my intention.
There will be multiple subfolders with different user access.

Best Regards
Michael