Nextcloud sharing security issues
Tracked by Jolla
(In release)
asked 2020-04-08 12:23:00 +0300
We had to learn that Nextcloud sharing uses a hard coded path - that's not good at all. Now I tried to share a note to my Nextcloud, but my Account just has a German renamed folder, no private folder "Documents".
But I have a Documents folder with read/write permissions that another user shared with m in my Nextcloud instance. So the uploaded Note was saved in this shared folder.
It's necessary that we users could set up the path by ourselves (same for the Gallery App).
looking at the other questions posted regarding the new Nextcloud integration, the hardcoded path problem pops up almost everywhere.
rozgwi ( 2020-04-08 13:26:11 +0300 )editI'd suggest renaming this question to ask for configurable paths instead of hardcoded ones. both for reasons of security as described by you @Cryx and general user experience.
I'd be surprised if Nextcloud's documentation would not contain some hints about dealing with localized folder names. so configurability + sane defaults should be possible.
The sources for the nextcloud integration backend parts aren't available, are they?
Blizzz ( 2020-04-08 13:32:00 +0300 )edit