Another backport to proper fix #1091614.

diff --git a/debian/patches/0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch b/debian/patches/0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch
new file mode 100644 (file)
index 0000000..ca6882e
--- /dev/null
+++ b/debian/patches/0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch
@@ -0,0 +1,182 @@
+From: =?utf-8?q?Sandro_Knau=C3=9F?= <hefee@debian.org>
+Date: Sun, 5 Jan 2025 23:17:28 +0100
+Subject: Revert "ensure no any user writable permissions in Nextcloud sync
+ folder"
+
+This reverts commit 5b2af166d3d9c8537c565922750392d4a3f6610e.
+---
+ src/csync/csync.h                      |  2 --
+ src/csync/vio/csync_vio_local_unix.cpp |  2 --
+ src/libsync/discovery.cpp              | 11 -----------
+ src/libsync/discoveryphase.cpp         |  1 -
+ src/libsync/discoveryphase.h           |  1 -
+ src/libsync/filesystem.cpp             |  1 -
+ src/libsync/owncloudpropagator.cpp     | 14 +++++++++++---
+ src/libsync/syncengine.cpp             |  4 ----
+ src/libsync/syncfileitem.h             |  2 --
+ 9 files changed, 11 insertions(+), 27 deletions(-)
+
+diff --git a/src/csync/csync.h b/src/csync/csync.h
+index 9da7497..5c8fbc0 100644
+--- a/src/csync/csync.h
++++ b/src/csync/csync.h
+@@ -217,7 +217,6 @@ struct OCSYNC_EXPORT csync_file_stat_s {
+   bool is_hidden BITFIELD(1); // Not saved in the DB, only used during discovery for local files.
+   bool isE2eEncrypted BITFIELD(1);
+   bool is_metadata_missing BITFIELD(1); // Indicates the file has missing metadata, f.ex. the file is not a placeholder in case of vfs.
+-  bool isPermissionsInvalid BITFIELD(1);
+ 
+   QByteArray path;
+   QByteArray rename_path;
+@@ -245,7 +244,6 @@ struct OCSYNC_EXPORT csync_file_stat_s {
+     , is_hidden(false)
+     , isE2eEncrypted(false)
+     , is_metadata_missing(false)
+-    , isPermissionsInvalid(false)
+   { }
+ };
+ 
+diff --git a/src/csync/vio/csync_vio_local_unix.cpp b/src/csync/vio/csync_vio_local_unix.cpp
+index ec47ab3..c5e22ab 100644
+--- a/src/csync/vio/csync_vio_local_unix.cpp
++++ b/src/csync/vio/csync_vio_local_unix.cpp
+@@ -170,7 +170,5 @@ static int _csync_vio_local_stat_mb(const mbchar_t *wuri, csync_file_stat_t *buf
+   buf->inode = sb.st_ino;
+   buf->modtime = sb.st_mtime;
+   buf->size = sb.st_size;
+-  buf->isPermissionsInvalid = (sb.st_mode & S_IWOTH) == S_IWOTH;
+-
+   return 0;
+ }
+diff --git a/src/libsync/discovery.cpp b/src/libsync/discovery.cpp
+index e842f82..fc92795 100644
+--- a/src/libsync/discovery.cpp
++++ b/src/libsync/discovery.cpp
+@@ -1070,10 +1070,6 @@ void ProcessDirectoryJob::processFileAnalyzeLocalInfo(
+         if (_queryLocal != NormalQuery && _queryServer != NormalQuery)
+             recurse = false;
+ 
+-        if (localEntry.isPermissionsInvalid) {
+-            recurse = true;
+-        }
+-
+         if ((item->_direction == SyncFileItem::Down || item->_instruction == CSYNC_INSTRUCTION_CONFLICT || item->_instruction == CSYNC_INSTRUCTION_NEW || item->_instruction == CSYNC_INSTRUCTION_SYNC) &&
+                 (item->_modtime <= 0 || item->_modtime >= 0xFFFFFFFF)) {
+             item->_instruction = CSYNC_INSTRUCTION_ERROR;
+@@ -1101,13 +1097,6 @@ void ProcessDirectoryJob::processFileAnalyzeLocalInfo(
+             }
+         }
+ 
+-        if (localEntry.isPermissionsInvalid && item->_instruction == CSyncEnums::CSYNC_INSTRUCTION_NONE) {
+-            item->_instruction = CSYNC_INSTRUCTION_UPDATE_METADATA;
+-            item->_direction = SyncFileItem::Down;
+-        }
+-
+-        item->isPermissionsInvalid = localEntry.isPermissionsInvalid;
+-
+         auto recurseQueryLocal = _queryLocal == ParentNotChanged ? ParentNotChanged : localEntry.isDirectory || item->_instruction == CSYNC_INSTRUCTION_RENAME ? NormalQuery : ParentDontExist;
+         processFileFinalize(item, path, recurse, recurseQueryLocal, recurseQueryServer);
+     };
+diff --git a/src/libsync/discoveryphase.cpp b/src/libsync/discoveryphase.cpp
+index 6cd226f..3ca34e9 100644
+--- a/src/libsync/discoveryphase.cpp
++++ b/src/libsync/discoveryphase.cpp
+@@ -348,7 +348,6 @@ void DiscoverySingleLocalDirectoryJob::run() {
+         i.isSymLink = dirent->type == ItemTypeSoftLink;
+         i.isVirtualFile = dirent->type == ItemTypeVirtualFile || dirent->type == ItemTypeVirtualFileDownload;
+         i.isMetadataMissing = dirent->is_metadata_missing;
+-        i.isPermissionsInvalid = dirent->isPermissionsInvalid;
+         i.type = dirent->type;
+         results.push_back(i);
+     }
+diff --git a/src/libsync/discoveryphase.h b/src/libsync/discoveryphase.h
+index bb932f5..2e801de 100644
+--- a/src/libsync/discoveryphase.h
++++ b/src/libsync/discoveryphase.h
+@@ -106,7 +106,6 @@ struct LocalInfo
+     bool isVirtualFile = false;
+     bool isSymLink = false;
+     bool isMetadataMissing = false;
+-    bool isPermissionsInvalid = false;
+     [[nodiscard]] bool isValid() const { return !name.isNull(); }
+ };
+ 
+diff --git a/src/libsync/filesystem.cpp b/src/libsync/filesystem.cpp
+index 9dbdde6..2931a3d 100644
+--- a/src/libsync/filesystem.cpp
++++ b/src/libsync/filesystem.cpp
+@@ -468,7 +468,6 @@ bool FileSystem::setFolderPermissions(const QString &path,
+         case OCC::FileSystem::FolderPermissions::ReadOnly:
+             break;
+         case OCC::FileSystem::FolderPermissions::ReadWrite:
+-            std::filesystem::permissions(stdStrPath, std::filesystem::perms::others_write, std::filesystem::perm_options::remove);
+             std::filesystem::permissions(stdStrPath, std::filesystem::perms::owner_write, std::filesystem::perm_options::add);
+             break;
+         }
+diff --git a/src/libsync/owncloudpropagator.cpp b/src/libsync/owncloudpropagator.cpp
+index f10fc61..193da94 100644
+--- a/src/libsync/owncloudpropagator.cpp
++++ b/src/libsync/owncloudpropagator.cpp
+@@ -1461,9 +1461,15 @@ void PropagateDirectory::slotSubJobsFinished(SyncFileItem::Status status)
+                 try {
+                     if (FileSystem::fileExists(propagator()->fullLocalPath(_item->_file))) {
+                         FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_file), FileSystem::FolderPermissions::ReadOnly);
++                        qCDebug(lcDirectory) << "old permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions());
++                        std::filesystem::permissions(propagator()->fullLocalPath(_item->_file).toStdWString(), std::filesystem::perms::owner_write | std::filesystem::perms::group_write | std::filesystem::perms::others_write, std::filesystem::perm_options::remove);
++                        qCDebug(lcDirectory) << "new permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions());
+                     }
+                     if (!_item->_renameTarget.isEmpty() && FileSystem::fileExists(propagator()->fullLocalPath(_item->_renameTarget))) {
+                         FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_renameTarget), FileSystem::FolderPermissions::ReadOnly);
++                        qCDebug(lcDirectory) << "old permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions());
++                        std::filesystem::permissions(propagator()->fullLocalPath(_item->_renameTarget).toStdWString(), std::filesystem::perms::owner_write | std::filesystem::perms::group_write | std::filesystem::perms::others_write, std::filesystem::perm_options::remove);
++                        qCDebug(lcDirectory) << "new permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions());
+                     }
+                 }
+                 catch (const std::filesystem::filesystem_error &e)
+@@ -1475,13 +1481,15 @@ void PropagateDirectory::slotSubJobsFinished(SyncFileItem::Status status)
+             } else {
+                 try {
+                     if (FileSystem::fileExists(propagator()->fullLocalPath(_item->_file))) {
+-                        qCDebug(lcDirectory) << propagator()->fullLocalPath(_item->_file) << "old permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions());
+                         FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_file), FileSystem::FolderPermissions::ReadWrite);
+-                        qCDebug(lcDirectory) << propagator()->fullLocalPath(_item->_file) << "new permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions());
++                        qCDebug(lcDirectory) << "old permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions());
++                        std::filesystem::permissions(propagator()->fullLocalPath(_item->_file).toStdWString(), std::filesystem::perms::owner_write, std::filesystem::perm_options::add);
++                        qCDebug(lcDirectory) << "new permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_file).toStdWString()).permissions());
+                     }
+                     if (!_item->_renameTarget.isEmpty() && FileSystem::fileExists(propagator()->fullLocalPath(_item->_renameTarget))) {
+-                        qCDebug(lcDirectory) << "old permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions());
+                         FileSystem::setFolderPermissions(propagator()->fullLocalPath(_item->_renameTarget), FileSystem::FolderPermissions::ReadWrite);
++                        qCDebug(lcDirectory) << "old permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions());
++                        std::filesystem::permissions(propagator()->fullLocalPath(_item->_renameTarget).toStdWString(), std::filesystem::perms::owner_write, std::filesystem::perm_options::add);
+                         qCDebug(lcDirectory) << "new permissions" << static_cast<int>(std::filesystem::status(propagator()->fullLocalPath(_item->_renameTarget).toStdWString()).permissions());
+                     }
+                 }
+diff --git a/src/libsync/syncengine.cpp b/src/libsync/syncengine.cpp
+index c64b921..db23060 100644
+--- a/src/libsync/syncengine.cpp
++++ b/src/libsync/syncengine.cpp
+@@ -363,10 +363,6 @@ void OCC::SyncEngine::slotItemDiscovered(const OCC::SyncFileItemPtr &item)
+                 const bool isReadOnly = !item->_remotePerm.isNull() && !item->_remotePerm.hasPermission(RemotePermissions::CanWrite);
+                 modificationHappened = FileSystem::setFileReadOnlyWeak(filePath, isReadOnly);
+             }
+-            if (item->isPermissionsInvalid) {
+-                const auto isReadOnly = !item->_remotePerm.isNull() && !item->_remotePerm.hasPermission(RemotePermissions::CanWrite);
+-                FileSystem::setFileReadOnly(filePath, isReadOnly);
+-            }
+ 
+             modificationHappened |= item->_size != prev._fileSize;
+ 
+diff --git a/src/libsync/syncfileitem.h b/src/libsync/syncfileitem.h
+index 46ee496..d90348a 100644
+--- a/src/libsync/syncfileitem.h
++++ b/src/libsync/syncfileitem.h
+@@ -343,8 +343,6 @@ public:
+     bool _isLivePhoto = false;
+     QString _livePhotoFile;
+ 
+-    bool isPermissionsInvalid = false;
+-
+     QString _discoveryResult;
+ };
+ 

diff --git a/debian/patches/series b/debian/patches/series
index 19fadcd04ea05abb4804dc5e8b4532524fb011d7..b0deb47c44523f92eefd295268cf03f7a962902e 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,3 +4,4 @@
 0004-GIT_SHA1-points-to-the-sha1-of-upstream.patch
 0004-Don-t-use-GuiPrivate.patch
 0006-Revert-better-logs-and-factor-common-code-in-folder-.patch
+0007-Revert-ensure-no-any-user-writable-permissions-in-Ne.patch