Add ability for admin to hide folders from users

[chrisbeardy]

Potentially issue for file access control

Expected behaviour

When tag is added to restrict access control, would like ability to hide folder from all users without permission so that they cannot see it or enter it.

Actual behaviour

Message at top of screen saying do not have permission to upload/download files here

[MorrisJobke]

@chrisbeardy What is the use case behind this? I don't see any scenario why an admin should hide a users files and I find it quite disturbing. This would then also mean that you for example sync it, add the tag and then the client deletes the files.

cc @nickvergessen @karlitschek

[chrisbeardy]

@MorrisJobke

Say I have 2 folders, A and B, two users A and B. I have set up user permissions so that user A can only use folder A for uploading/downloading and user B can only use folder B for uploading/downloading. I have done this using invisible tags and the file access control using this example https://docs.nextcloud.com/server/10/admin_manual/configuration_files/files_access_control.html

What I want to be able to do I stop User A from seeing User B's folder and vise versa.

[MorrisJobke]

Say I have 2 folders, A and B, two users A and B. I have set up user permissions so that user A can only use folder A for uploading/downloading and user B can only use folder B for uploading/downloading. I have done this using invisible tags and the file access control using this example

Having an admin with folders A and B, sharing A to userA and B to userB ... problem solved without juggling with the tagging and permissions. Or do I see this wrong?

[MorrisJobke]

Say I have 2 folders, A and B, two users A and B. I have set up user permissions so that user A can only use folder A for uploading/downloading and user B can only use folder B for uploading/downloading. I have done this using invisible tags and the file access control using this example https://docs.nextcloud.com/server/10/admin_manual/configuration_files/files_access_control.html

Where those two folders are coming from? A and B is created by userA and by userB in their home folder ... why should the admin then remove it again if they are user created?

[chrisbeardy]

@MorrisJobke

sorry if I'm not being clear, I'll try and explain a bit more specific to my application.

I have 3 users (Chris, Dan and Jason). I set up nextcloud using a VM and have attached a network share using SMB, the network share contains the users home folders, called Chris, Dan and Jason along with other folders that we all use. The problem I have is as soon as I attached the network share all three users can see all the folders. what I would like is that Dan cannot see Chris and Jason's home folders and so on.

I understand admin could create folders and only share them with the correct users however as I set up network share, it seems that all the users have access to all the folders on the network share.

I hope this makes sense.

[MorrisJobke]

I still doubt that hiding is here the best approach, because it could cause weird side effect if now Dan creates a folder named Chris because for him this folder doesn't exist and then it collides with this magic folder.

For SMB shares we also have the way to have one mount point with a special variable per user. This the is something like users/$user and gets mounted to Home/ for example. Then Dan would have users/Dan mounted at Home/ and Chris would have users/Chris mounted in Home/. For the shared content you would add a second mount that is the same for all users. Something like shared/ on the SMB which is mounted for each user to Team/.

That concept is already in place and is used heavily by our users.

[chrisbeardy]

I see that that could be the case and therefore hiding folders could be dangerous. I shall implement what you have suggested as this functionality seems much more suited. Thanks for your help and understanding on this topic.

[MorrisJobke]

I see that that could be the case and therefore hiding folders could be dangerous. I shall implement what you have suggested as this functionality seems much more suited. Thanks for your help and understanding on this topic.

Thanks for you explanation. We always try to understand the reasons for given features. Sorry that this not went the way you imagined, but implementing everything would lead to a huge very complex system that doesn't work as stable anymore. So we try to find solutions with the current implementation.