Revert "ensure no any user writable permissions in Nextcloud sync folder"

This reverts commit 5b2af166d3d9c8537c565922750392d4a3f6610e.

Updated to apply and match for 3.16.6.

Origin: backport
Bug-Debian: https://bugs.debian.org/1091614
Bug: https://github.com/nextcloud/desktop/issues/7613
Forwarded: not-needed
Last-Update: 2025-07-25

Gbp-Pq: Name 0006-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch

diff --git a/src/csync/csync.h b/src/csync/csync.h
index 8329020f5846321621d6c799ac647f1bcdc7aeba..ff1ec56a2fcc7a5c08d9e019d4c03325b49e8c43 100644 (file)
--- a/src/csync/csync.h
+++ b/src/csync/csync.h
@@ -218,7 +218,6 @@ struct OCSYNC_EXPORT csync_file_stat_s {
   bool is_hidden BITFIELD(1); // Not saved in the DB, only used during discovery for local files.
   bool isE2eEncrypted BITFIELD(1);
   bool is_metadata_missing BITFIELD(1); // Indicates the file has missing metadata, f.ex. the file is not a placeholder in case of vfs.
-  bool isPermissionsInvalid BITFIELD(1);
 
   QByteArray path;
   QByteArray rename_path;
@@ -246,7 +245,6 @@ struct OCSYNC_EXPORT csync_file_stat_s {
     , is_hidden(false)
     , isE2eEncrypted(false)
     , is_metadata_missing(false)
-    , isPermissionsInvalid(false)
   { }
 };
 

diff --git a/src/csync/vio/csync_vio_local_unix.cpp b/src/csync/vio/csync_vio_local_unix.cpp
index 8f319a3e4b23f4a01259e32523ec316bad05c520..55cd0f0922c3151816de325056a743c3a2fd4255 100644 (file)
--- a/src/csync/vio/csync_vio_local_unix.cpp
+++ b/src/csync/vio/csync_vio_local_unix.cpp
@@ -169,7 +169,6 @@ static int _csync_vio_local_stat_mb(const mbchar_t *wuri, csync_file_stat_t *buf
   buf->inode = sb.st_ino;
   buf->modtime = sb.st_mtime;
   buf->size = sb.st_size;
-  buf->isPermissionsInvalid = (sb.st_mode & S_IWOTH) == S_IWOTH;
 
   return 0;
 }

diff --git a/src/libsync/discovery.cpp b/src/libsync/discovery.cpp
index c95af63c7674c540e8676fcc935162661f6e99f2..39c65a2936e473b23d614aaff04086707abd2d0c 100644 (file)
--- a/src/libsync/discovery.cpp
+++ b/src/libsync/discovery.cpp
@@ -1130,10 +1130,6 @@ void ProcessDirectoryJob::processFileAnalyzeLocalInfo(
         if (_queryLocal != NormalQuery && _queryServer != NormalQuery)
             recurse = false;
 
-        if (localEntry.isPermissionsInvalid) {
-            recurse = true;
-        }
-
         if ((item->_direction == SyncFileItem::Down || item->_instruction == CSYNC_INSTRUCTION_CONFLICT || item->_instruction == CSYNC_INSTRUCTION_NEW || item->_instruction == CSYNC_INSTRUCTION_SYNC) &&
                 item->_direction != SyncFileItem::Up &&
                 (item->_modtime <= 0 || item->_modtime >= 0xFFFFFFFF)) {
@@ -1162,13 +1158,6 @@ void ProcessDirectoryJob::processFileAnalyzeLocalInfo(
             }
         }
 
-        if (localEntry.isPermissionsInvalid && item->_instruction == CSyncEnums::CSYNC_INSTRUCTION_NONE) {
-            item->_instruction = CSYNC_INSTRUCTION_UPDATE_METADATA;
-            item->_direction = SyncFileItem::Down;
-        }
-
-        item->isPermissionsInvalid = localEntry.isPermissionsInvalid;
-
         auto recurseQueryLocal = _queryLocal == ParentNotChanged ? ParentNotChanged : localEntry.isDirectory || item->_instruction == CSYNC_INSTRUCTION_RENAME ? NormalQuery : ParentDontExist;
         if (item->isDirectory() && serverEntry.isValid() && dbEntry.isValid() && serverEntry.etag == dbEntry._etag && serverEntry.remotePerm != dbEntry._remotePerm) {
             recurseQueryServer = ParentNotChanged;

diff --git a/src/libsync/discoveryphase.cpp b/src/libsync/discoveryphase.cpp
index 7edd684675cc943a90f4e42c2dcfc7638f64e640..f881a21c8245c5671667844b0d4484202814f897 100644 (file)
--- a/src/libsync/discoveryphase.cpp
+++ b/src/libsync/discoveryphase.cpp
@@ -370,7 +370,6 @@ void DiscoverySingleLocalDirectoryJob::run() {
         i.isSymLink = dirent->type == ItemTypeSoftLink;
         i.isVirtualFile = dirent->type == ItemTypeVirtualFile || dirent->type == ItemTypeVirtualFileDownload;
         i.isMetadataMissing = dirent->is_metadata_missing;
-        i.isPermissionsInvalid = dirent->isPermissionsInvalid;
         i.type = dirent->type;
         results.push_back(i);
     }

diff --git a/src/libsync/discoveryphase.h b/src/libsync/discoveryphase.h
index 0c9edceac1181b3cc0b300f20346c11e0863e003..913f37fe1ccf89a011857538950e19dbb6e7a88e 100644 (file)
--- a/src/libsync/discoveryphase.h
+++ b/src/libsync/discoveryphase.h
@@ -107,7 +107,6 @@ struct LocalInfo
     bool isVirtualFile = false;
     bool isSymLink = false;
     bool isMetadataMissing = false;
-    bool isPermissionsInvalid = false;
     [[nodiscard]] bool isValid() const { return !name.isNull(); }
 };
 

diff --git a/src/libsync/owncloudpropagator.cpp b/src/libsync/owncloudpropagator.cpp
index fba85c539ca1609a70b728014ef1d089c7c18410..10eedaf7367376f45b21e6ab866cd9b6e3185512 100644 (file)
--- a/src/libsync/owncloudpropagator.cpp
+++ b/src/libsync/owncloudpropagator.cpp
@@ -1472,12 +1472,18 @@ void PropagateDirectory::slotSubJobsFinished(SyncFileItem::Status status)
                 try {
                     if (const auto fileName = propagator()->fullLocalPath(_item->_file); FileSystem::fileExists(fileName)) {
                         FileSystem::setFolderPermissions(fileName, FileSystem::FolderPermissions::ReadOnly);
+                        qCDebug(lcDirectory) << fileName << "permissions changed: old permissions" << static_cast<int>(std::filesystem::status(fileName.toStdWString()).permissions());
+                        std::filesystem::permissions(fileName.toStdWString(), std::filesystem::perms::owner_write | std::filesystem::perms::group_write | std::filesystem::perms::others_write, std::filesystem::perm_options::remove);
                         Q_EMIT propagator()->touchedFile(fileName);
+                        qCDebug(lcDirectory) << fileName << "applied new permissions" << static_cast<int>(std::filesystem::status(fileName.toStdWString()).permissions());
                     }
                     if (!_item->_renameTarget.isEmpty() && FileSystem::fileExists(propagator()->fullLocalPath(_item->_renameTarget))) {
                         const auto fileName = propagator()->fullLocalPath(_item->_renameTarget);
                         FileSystem::setFolderPermissions(fileName, FileSystem::FolderPermissions::ReadOnly);
+                        qCDebug(lcDirectory) << fileName << "permissions changed: old permissions" << static_cast<int>(std::filesystem::status(fileName.toStdWString()).permissions());
+                        std::filesystem::permissions(fileName.toStdWString(), std::filesystem::perms::owner_write | std::filesystem::perms::group_write | std::filesystem::perms::others_write, std::filesystem::perm_options::remove);
                         Q_EMIT propagator()->touchedFile(fileName);
+                        qCDebug(lcDirectory) << fileName << "applied new permissions" << static_cast<int>(std::filesystem::status(fileName.toStdWString()).permissions());
                     }
                 }
                 catch (const std::filesystem::filesystem_error &e)
@@ -1504,6 +1510,7 @@ void PropagateDirectory::slotSubJobsFinished(SyncFileItem::Status status)
                     {
                         qCDebug(lcDirectory) << fileName << "permissions changed: old permissions" << static_cast<int>(std::filesystem::status(fileName.toStdWString()).permissions());
                         FileSystem::setFolderPermissions(fileName, FileSystem::FolderPermissions::ReadWrite);
+                        std::filesystem::permissions(fileName.toStdWString(), std::filesystem::perms::owner_write, std::filesystem::perm_options::add);
                         Q_EMIT propagator()->touchedFile(fileName);
                         qCDebug(lcDirectory) << fileName << "applied new permissions" << static_cast<int>(std::filesystem::status(fileName.toStdWString()).permissions());
                     };

diff --git a/src/libsync/syncengine.cpp b/src/libsync/syncengine.cpp
index e24ce8a308b1ebd6c1b24f66029ad675e6e0e7b4..8237905e93a6596b04a6ee25a9d92d6e3c6bdf8a 100644 (file)
--- a/src/libsync/syncengine.cpp
+++ b/src/libsync/syncengine.cpp
@@ -362,10 +362,6 @@ void OCC::SyncEngine::slotItemDiscovered(const OCC::SyncFileItemPtr &item)
                 const bool isReadOnly = !item->_remotePerm.isNull() && !item->_remotePerm.hasPermission(RemotePermissions::CanWrite);
                 modificationHappened = FileSystem::setFileReadOnlyWeak(filePath, isReadOnly);
             }
-            if (item->isPermissionsInvalid) {
-                const auto isReadOnly = !item->_remotePerm.isNull() && !item->_remotePerm.hasPermission(RemotePermissions::CanWrite);
-                FileSystem::setFileReadOnly(filePath, isReadOnly);
-            }
 
             modificationHappened |= item->_size != prev._fileSize;
 

diff --git a/src/libsync/syncfileitem.h b/src/libsync/syncfileitem.h
index 154d13a745becf56ce2ce225bcba966edc193874..041e48db4c89815aada443801f17347654a36600 100644 (file)
--- a/src/libsync/syncfileitem.h
+++ b/src/libsync/syncfileitem.h
@@ -344,8 +344,6 @@ public:
     bool _isLivePhoto = false;
     QString _livePhotoFile;
 
-    bool isPermissionsInvalid = false;
-
     QString _discoveryResult;
 
     /// if true, requests the file to be permanently deleted instead of moved to the trashbin