Users in groups excluded from sharing can initiate shares if also a member of a non-excluded group

[Zulgrib]

Steps to reproduce

1. Create a "No sharing" group
2. Add a user to "No sharing" group
3. Configure to not allow "No sharing" group to initiate shares
4. Share folder with another user

Expected behaviour

The user shouldn't be able to initiate a share

Actual behaviour

The user initiate a share successfully that can be seen and modified by target user

Server configuration

Operating system:
Shared host

Web server:
Apache

Database:
MySQL 5.6.34

PHP version:
7.0.15

Nextcloud version: (see Nextcloud admin page)
11.0.0
Updated from an older Nextcloud/ownCloud or fresh install:
Fresh
Where did you install Nextcloud from:
Unarchive archive file downloaded from nextcloud site
Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

The content of config/config.php:

Config report

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

or 

Insert your config.php content here
(Without the database password, passwordsalt and secret)

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: Chrome 56

Operating system: Any

Logs

Web server error log

Web server error log

``` Error index Error: Call to undefined function OCA\Theming\mime_content_type() ```

Nextcloud log (data/nextcloud.log)

Nextcloud log

``` Insert your Nextcloud log here ```

Browser log

Browser log

``` Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

</details>

[Zulgrib]

If the user is in any group that isn't restricted, the user isn't restricted anymore, we should be able to do a shotgun approach where if the member is in a specific group, there is no possibilities at all to initiate a share with annyone, or we need a whitelist instead of blacklist.

[aRandomKiwi]

Hi @Zulgrib ,

We solved this "issue" (depending of your case its best to deal with whitelist instead of NC's kind of blacklist which impose all groups of an user to match to revoke his share right), by editing "lib/private/Share20/Manager.php" and in the function "sharingDisabledForUser" definition replace

if (!empty($usersGroups)) {
$remainingGroups = array_diff($usersGroups, $excludedGroups);
                                // if the user is only in groups which are disabled for sharing then
                                // sharing is also disabled for the user
                              if (empty($remainingGroups)) {
                                        $this->sharingDisabledForUsersCache[$userId] = true;
                                        return true;
                                }
                        }
   }

                $this->sharingDisabledForUsersCache[$userId] =false;
                return false;

by :

       if (!empty($usersGroups)) {
                                //cherche si group dans excludedGroups (inversion)
                                for($i=0;$i!=sizeof($usersGroups);$i++){
                                        for($j=0;$j!=sizeof($excludedGroups);$j++){
                                                if($usersGroups[$i] == $excludedGroups[$j]){
                                                        $this->sharingDisabledForUsersCache[$userId] = false;
                                                        return false;
                                                }
                                        }
                                }
                                /*$remainingGroups = array_diff($usersGroups, $excludedGroups);
                                // if the user is only in groups which are disabled for sharing then
                                // sharing is also disabled for the user
                               if (empty($remainingGroups)) {
                                        $this->sharingDisabledForUsersCache[$userId] = true;
                                        return true;
                                }*/
                        }
                }

                $this->sharingDisabledForUsersCache[$userId] = true;
                return true;

So you just need to put in the admin setting "groups excluded from sharing", the list of allowed groups, so every others groups cannot share.

Note : We using a NC 13.0.1, but its the same code for NC 11 or 12, there is also a file "/lib/private/legacy/util.php" where there is a "isSharingDisabledForUser" function, not sure if needed to change it also because it work without do it.

[herring-swe]

If the user is in any group that isn't restricted, the user isn't restricted anymore, we should be able to do a shotgun approach where if the member is in a specific group, there is no possibilities at all to initiate a share with annyone, or we need a whitelist instead of blacklist.

I agree with this. The current behavior is not intuitive and the exclude groups value needs to be updated as we add more users/groups instead of just having a "non-share" group.

[CoMPaTech]

Just ran into this as well, expecting that sharing wouldn't be possible when a user is member of that group it doesn't work that way. I can appreciate the 'other way around', but this solicits for another box indeed - that way regression wouldn't be broken.

A oneliner would be welcome as description, so for the existing functionality ("if user is only member of below groups, don't allow sharing:") - and adding a new functionality ("sharing is only allowed if member of (one or more of) these groups:". Where one could envision a simple toggle above that stating 'whitelist / blacklist'?

[hydro-test]

It would be nice to add to this the ability to assign different groups to provide basic sharing and sharing by links.
For example, if the user is a member of group-1, then he can share (except for sharing by links), if he is a member of group-2, then he can also share by links; and most importantly, regardless of membership in any other groups.