Skip to content

Group-based Circle memberships prevent member list access in Collectives and Contacts#2642

Description

@michiey

How to use GitHub

  • Please use the 馃憤 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Hi,

I initially reported an issue with the Collectives app showing the message "Could not fetch collective details", but after further investigation it turned out to be related to permissions in the Circles app and the way we configured it.

Related Collectives issue: 2630

Our intention was to manage access to Nextcloud content exclusively through group memberships, without having to manage individual users separately in Teams/Circles. So the users are members of groups and the groups are added as members of those Circles.

The users are able to access, view, and edit the content of the Collectives as expected, so the permissions themselves seem to work correctly. However, they can't see the member list of the Collective and get the error message. Changing the role of the group within the Circle to moderator or administrator does not change the behaviour.

When a user opens the Circle in the Contacts app, they receive the message "There was an error fetching the member list" and the member list only shows "You currently have no access to the member list".
The browser developer tools show a 403 response for the following request:
GET https://nextcloud.mydomain.de/ocs/v2.php/apps/circles/circles/dZtJzlxJPY6WwQjjZmEVgjGQQr1GPtw/members

When i add a user directly to a circle, everything works as expected, there are no error messages in the Contacts app or in Collectives and the user can see the groups as part of the Circle/Team too.

Best regards,
Mike

Steps to reproduce

  1. Create a group and add a user
  2. Add this group to a circle without adding the user itself
  3. Login as this user and open the Circle inside the Contacts app

Expected behaviour

The user should get not error message and should see the group as part of the Circle

Actual behaviour

The user gets an error message and can't see the user list

Server configuration

Nextcloud version: Nextcloud AIO Hub 26 Winter (33.0.6)

List of activated apps
Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - bruteforcesettings: 6.0.0
  - calendar: 6.5.0
  - camerarawpreviews: 1.1.1
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - collectives: 4.4.2
  - comments: 1.23.0
  - contacts: 8.7.3
  - contactsinteraction: 1.14.1
  - dashboard: 7.13.0
  - dav: 1.36.0
  - event_update_notification: 2.9.0
  - external: 8.0.1
  - federatedfilesharing: 1.23.0
  - files: 2.5.0
  - files_antivirus: 6.3.0
  - files_downloadlimit: 5.1.0
  - files_external: 1.25.1
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - groupfolders: 21.0.9
  - impersonate: 4.0.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - memories: 8.1.0
  - nextcloud-aio: 0.8.0
  - nextcloud_announcements: 5.0.0
  - notifications: 6.0.0
  - notify_push: 1.3.3
  - oauth2: 1.21.0
  - password_policy: 5.0.0
  - photos: 6.0.0
  - previewgenerator: 5.14.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - quota_warning: 1.24.0
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - richdocuments: 10.2.1
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - socialsharing_email: 4.1.0
  - support: 5.0.0
  - survey_client: 5.0.0
  - systemtags: 1.23.0
  - tables: 2.2.0
  - text: 7.0.1
  - theming: 2.8.0
  - theming_customcss: 1.20.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_nextcloud_notification: 7.0.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - whiteboard: 1.5.9
  - workflowengine: 2.15.0
Disabled:
  - announcementcenter: 7.4.1 (installed 7.4.1)
  - app_api: 33.0.0 (installed 32.0.0)
  - deck: 1.17.4 (installed 1.17.4)
  - encryption: 2.21.0
  - federation: 1.23.0 (installed 1.22.0)
  - files_fulltextsearch: 33.0.0 (installed 33.0.0)
  - firstrunwizard: 6.0.0 (installed 4.0.0)
  - fulltextsearch: 33.0.0 (installed 33.0.0)
  - fulltextsearch_elasticsearch: 33.0.0 (installed 33.0.0)
  - notes: 6.0.1 (installed 6.0.1)
  - occweb: 0.2.3 (installed 0.2.3)
  - suspicious_login: 11.0.0 (installed 11.0.0)
  - tasks: 0.18.1 (installed 0.18.1)
  - terms_of_service: 4.7.0 (installed 4.7.0)
  - user_ldap: 1.24.0

Nextcloud configuration
{
    "system": {
        "one-click-instance": true,
        "one-click-instance.user-limit": 100,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "check_data_directory_permissions": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 3,
            "read_timeout": 10
        },
        "overwritehost": "nextcloud.mydomain.de",
        "overwriteprotocol": "https",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "nextcloud.mydomain.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "33.0.6.2",
        "overwrite.cli.url": "https:\/\/nextcloud.mydomain.de\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "updatechecker": false,
        "loglevel": 2,
        "log_type": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "log_rotate_size": 10485760,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "preview_max_x": 1024,
        "preview_max_y": 1024,
        "jpeg_quality": 70,
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Krita",
            "2": "OC\\Preview\\ImaginaryPDF",
            "3": "OC\\Preview\\HEIC",
            "4": "OC\\Preview\\ImaginaryPDF",
            "5": "OC\\Preview\\Image",
            "6": "OC\\Preview\\ImaginaryPDF",
            "7": "OC\\Preview\\Movie",
            "8": "OC\\Preview\\ImaginaryPDF"
        },
        "enable_previews": true,
        "upgrade.disable-web": true,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": 30,
        "simpleSignUpLink.shown": false,
        "share_folder": "\/Shared",
        "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
        "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726",
        "updatedirectory": "\/nc-updater",
        "maintenance_window_start": 100,
        "allow_local_remote_servers": true,
        "davstorage.request_timeout": 3600,
        "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425",
        "htaccess.RewriteBase": "\/",
        "dbpersistent": false,
        "auth.bruteforce.protection.enabled": true,
        "ratelimit.protection.enabled": true,
        "files_external_allow_create_new_local": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_key": "***REMOVED SENSITIVE VALUE***",
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/exiftool-amd64-musl",
        "memories.vod.path": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/go-vod-amd64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "default_phone_region": "DE",
        "default_language": "de",
        "default_locale": "de",
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "mail_sendmailmode": "smtp",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "allowed_admin_ranges": [
            "127.0.0.1\/8",
            "192.168.0.0\/16"
        ],
        "skeletondirectory": "\/mnt\/ncdata\/skeleton",
        "serverid": 445,
        "log_type_audit": "file",
        "logfile_audit": "\/var\/www\/html\/data\/audit.log",
        "update_channel": "stable",
        "eurooffice": {
            "editors_check_interval": 0,
            "jwt_secret": "6284da26d0457f7edb5df2f295ddb323333362abe1c205a7",
            "jwt_header": "AuthorizationJwt"
        },
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        },
        "defaultapp": "dashboard",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "DOMAIN": "nextcloud.mydomain.de",
        "AIO_VERSION": "v13.3.1"
    }
}

Browser

Browser name: Firefox

Browser version: 152.0.4

Operating system: Fedora Linux and Android

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions