Space without space manager

[NannaBarz]

It is possible to have a space without space owner

Steps to reproduce:

1. The space has two space manager
2. Space manager A removes the rights from space manager B
3. Space manager B removes at the same time the rights from space manager A
4. After refresh the space has no space manager

[kobergj]

Needs clarification:

• How to reproduce easily?
• Expected behaviour?

[dragonchaser]

related: #5967

[kobergj]

@NannaBarz we need your help here. It looks like a blocking issue for ocis but I cannot reproduce it locally. Can you add some insights on how we can reproduce it? It seems complicated as both request need to be processed at the same time...

[NannaBarz]

On https://0001.schule.owncloud.works/ I created a Space "Test Space"
I added k.wulf and gave her "kann verwalten" rights

Now she remove her rights to "kann anzeigen"
And I removed mine to "kann anzeigen"

After a refresh both have "kann anzeigen" rights and no Spaceadmin is there

I'm sorry that I wrote it wrong in the first post.

[micbar]

Right! Big Facepalm 🤦

@kobergj @kulmann we did something interesting.

Changes on the space permissions are using POST Requests, which in the backend triggers addSpaceMember(). This method does not check for a remaining manager. removeSpaceMember() checks it.

This only works if Anja and Katharina Wulf do not reload the page, because the web client doesn't show the operation when only one manager is present. That the backend allows that operation is also not correct.

Next finding: When i implement a check the backend returns Status 200 and an error inside the ocs error payload. The webUI doesn't show that error.

<?xml version="1.0" encoding="UTF-8"?>
<ocs>
  <meta>
    <status>error</status>
    <statuscode>403</statuscode>
    <message>can&#39;t remove the last manager</message>
  </meta>
</ocs>

[micbar]

@kobergj quick draft for a fix in cs3org/reva#3917

[kobergj]

Hehe. Ja, I found that out too. Looks like we did some double work. Had some comments on the fix. I'll assign this ticket to you since you seem eager to take it 😉

[kulmann]

Needing to expect / check for an error after having a 200 status code is a pretty weird requirement 😢

[kobergj]

Reading the PR it should return 403 not 200. Where does the 200 come from?

[kobergj]

Fix is in ocis master