Users with limited scope cannot create working share links

[Darkassassin07]

When a user with a limited scope creates a share link, the path passed to the share doesn't include the scope so the link doesn't work.

For example:

File: "/test/folder/helloworld.txt"

User with scope: "/test"

User creates share link for what they see: "/folder/helloworld.txt"

The created share link then uses the directory /folder/helloworld.txt without prepending /test/ so the file doesn't exist and 'something really went wrong' is presented. While the console spits out 'error fetching file info for share...' '...no such file or directory'.

[gtsteffaniak]

Thanks for reporting, I'll have this fixed this week in bugfix release.

[Darkassassin07]

Glad hear it's being worked on promptly.

Just wanted to note this is a pretty big security flaw as well.

Users could use this to escape their scope and share/gain access to files they never had permission to access:

Scope: '/users/-username-'

/users/a/test.txt

/users/b/users/a/text.txt

If user 'b' shared their file, the share would display the contents of user 'a's file.

[gtsteffaniak]

@Darkassassin07 That's not how shares work. A share's path and permissions are not associated with a user, they are associated with the index folder path.

When a user created a share, a share is created with exact path to the index location. when you access shares from a link, the backend looks up the share hash which has the share index path in memory.

[Darkassassin07]

I just now tested this, and the current behavior is EXACTLY as I described.

Because the incorrect path, which excludes the scope, is passed to the share when created; users can create shares which point to files outside of their scope.

Create a file:

/test/helloworld.txt

Put some content in it.

Create an empty file:

/user/test/helloworld.txt

Create a user with the scope: '/user'

With that user share the empty file they see '/test/helloworld.txt' (which is actually /user/test/helloworld.txt')

The file available in that share is not empty, it has the contents of the file that's outside the scope of the user that created it.

This gets worse when users share directories such as their own homepage ('/')...

[gtsteffaniak]

Ah youre right the scope was missing here, like how it is for other api's like resource

So its happening during scope creation, that is a security issue. Sorry just looked at the code, I thought this was after share creation.

[gtsteffaniak]

I plan to release a bugfix tomorrow with all the small issues that users have noticed, this will definitely be included.