SecureView. Download and Copy buttons are available for secure view file in the search result

[ScharfViktor]

ocis | 6.1.0+0b8559f91
web 9.1.0

started using https://github.com/owncloud/web/blob/master/docker-compose.yml

Steps:

• admin upload .png file -> (strange -no preview in the file list)
• admin add tag secure to .png file
• admin shares .png to einstein with secure view role
• einstein tries to find .png file by name and goes to search result

Actual:

1. einstein cannot see/add tags in the file in Shares with me page but can see tag secure in the filter in the search result
2. buttons Download Copy and Preview are available for .png file
3. einstein can see file preview here is wrong. einstein cannot see preview

[AlexAndBear]

I don't think with the current implementation of the search service this is not preventable, as we don't get the share permissions

[ScharfViktor]

then we need add permission because secure view feature becomes insecure:

case:

• admin creates share .txt file with secure view
• recipient can only open this file in collabora if -> he is in Shares with me page
• recipient goes to the search result -> he can open file using Onlyoffice

Screen.Recording.2024-07-15.at.15.27.07.mov

[JammingBen]

Can't we check for the missing DAV permission?

[ScharfViktor]

we added X: Securely Viewable https://owncloud.dev/apis/http/webdav/#supported-webdav-properties but response doesn't contains it. I'll create issue in ocis repo

[AlexAndBear]

How this feature is called secure at all if the file can be opened with something else than collabora ? 🫨
no matter if the permissions coming back from the server correct or incorrect ?

I think we have a security issue here

[micbar]

How this feature is called secure at all if the file can be opened with something else than collabora ? 🫨
no matter if the permissions coming back from the server correct or incorrect

Normal downloads are prohibited.

We made it possible to open the File in the webOffice.

Currently it "works as designed" except the full text search.

@butonic we didn't consider that "onlyoffice" is active on the same instance. Can we limit that?

[micbar]

Making this P1 because this should trigger a new rolling release.

[AlexAndBear]

Making this P1 because this should trigger a new rolling release.

I don't think we need any code changes in web as soon the permission will be exposed via search API, everything should work out of the box.
At least I designed it that way 🤔

[micbar]

Transfer to ocis