Shared file saved at wrong user.

[ChristNeeskens]

Steps to reproduce

1. Log on as user 1 and create a shared file
2. Log on as the user (user 2) who the file was shared with
3. Open the file as user 2, and use save as and save the file. You can't see the file anywhere.
4. Log on as user 1, you now have an unshared file created by user 2

Expected behaviour

The file saved as user 2 visible for user 2, and not for user 1

Actual behaviour

The file saved by user 2 is only visible by user 1

Server configuration

Linux version 4.4.0-98-generic (buildd@lcy01-03) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4) ) #121-Ubuntu SMP Tue Oct 10 14:24:03 UTC 2017

Web server:
Apacahe

Database:
Mariadb/mysql

PHP version:

Nextcloud version: (see Nextcloud admin page)
13.0.2

Updated from an older Nextcloud/ownCloud or fresh install:
Update from 13.0.?

Where did you install Nextcloud from:
According to https://docs.nextcloud.com/server/13/admin_manual/installation/source_installation.html

Signing status:
Comodo signed wildcard certificate

Signing status

No errors have been found.

List of activated apps:

App list

Enabled: - activity: 2.6.1 - admin_notifications: 1.0.1 - calendar: 1.6.1 - comments: 1.3.0 - contacts: 2.1.3 - dav: 1.4.6 - federatedfilesharing: 1.3.1 - federation: 1.3.0 - files: 1.8.0 - files_pdfviewer: 1.2.1 - files_rightclick: 0.8.4 - files_sharing: 1.5.0 - files_texteditor: 2.5.1 - files_trackdownloads: 1.2.2 - files_trashbin: 1.3.0 - files_versions: 1.6.0 - files_videoplayer: 1.2.0 - firstrunwizard: 2.2.1 - gallery: 18.0.0 - logreader: 2.0.0 - lookup_server_connector: 1.1.0 - nextcloud_announcements: 1.2.0 - notifications: 2.1.2 - oauth2: 1.1.0 - password_policy: 1.3.0 - previewgenerator: 1.0.9 - provisioning_api: 1.3.0 - quota_warning: 1.2.0 - registration: 0.4.2 - richdocuments: 2.0.8 - serverinfo: 1.3.0 - sharebymail: 1.3.0 - spreedme: 0.3.11 - survey_client: 1.1.0 - systemtags: 1.3.0 - theming: 1.4.4 - twofactor_backupcodes: 1.2.3 - unsplash: 1.1.1 - updatenotification: 1.3.0 - workflowengine: 1.3.0 Disabled: - admin_audit - encryption - files_downloadactivity - files_external - passman - user_external - user_ldap - user_saml

Nextcloud configuration:

Config report

{ "system": { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "localhost", "192.168.107.21", "cloud", "cloud.innocsi", ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "13.0.2.1", "dbname": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "***REMOVED SENSITIVE VALUE***", "maintenance": false, "mail_smtpmode": "smtp", "log_rotate_size": "10485760", "memcache.local": "\\OC\\Memcache\\Redis", "filelocking.enabled": true, "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 0, "timeout": 0, "dbindex": 0, "password": "***REMOVED SENSITIVE VALUE***" }, "htaccess.RewriteBase": "\/", "loglevel": "2", "log_type": "file", "logfile": "\/var\/ncdata\/nextcloud.log", "logtimezone": "Europe\/Amsterdam", "mail_smtpsecure": "ssl", "mail_smtpauthtype": "LOGIN", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtpauth": 1, "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "465", "mail_smtpname": "***REMOVED SENSITIVE VALUE***", "mail_smtppassword": "***REMOVED SENSITIVE VALUE***", "theme": "" } }

Are you using external storage, if yes which one: local/smb/sftp/...
No

Are you using encryption: yes/no
No

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
No

Client configuration

Browser:
IE/Edge/Chrome

Operating system:
Windows 10

[rullzer]

From what app do you us save as?

[ChristNeeskens]

Sorry, forgot to add that as it is indeed an important part of this problem.
It was a document being 'saved as' using collabora office

[dirigit]

@ChristNeeskens

Expected behaviour

The file saved as user 2 visible for user 2, and not for user 1

Actual behaviour

The file saved by user 2 is only visible by user 1

hm. Something is wrong for sure but, aren't there two different scenarios at least:

1. User 1 shares file in R/W mode with user x. user x works on it and does not change filename while saving his work.

IMHO file should be visible for user 1 AND user x (collaboration).

2. User 1 shares file in R/W mode with user x. user x works on it and saves work in new file in same directory.

New file -> not shared -> not visible to user 1 -> no collaboration (except directory settings force sharing).

Inheriting permissions might open a can of worms but, in real collaboration it should be possible without further hazzles IMHO.

Example:

1. User 1 shares a directory with a group of people in some mode. New file a.b should inherit permissions of group than EXCEPT permissions are changed for this very new file a.b.
2. User 1 shares a specific file (not whole directory). This file should keep permissions and visibility as long as permissions are not changed by owner.

And so on.

cu, diri

[ChristNeeskens]

The below scenario works as expexted:
User 1 creates a file, shares it and user 2 modifies it and saves it.
Both users now have the same modified file.

But, when user 2 chooses save as on a shared file, I believe it shouldn't be shared automatically. If it was in a shared folder it's a different story, but a shared file.

What I would have expected is indeed scenario 2
User X modifies file, and chooses save as and saves it as a file under the USer X account (not a shared folder).
Than I would expect that user X has that file, but user X doesn't have any new file, instead only user 1 has a new file. Though this user shouldn't have that file.

[rullzer]

Please move this to https://github.com/nextcloud/richdocuments