Dragging a file on a shared folder checks your quota while dragging a file inside an *opened* shared folder checks quota of folder owner

[mlell]

#I am running nextcloud 12.0.0 and set up my users to have a very small quota (1MiB) to force them to write in a shared folder, created by the administrator. However, in the web interface, if the user drags a file on the icon of the shared folder, a "Not enough storage" error is displayed. If she opens the shared folder first and drags the file inside subsequently, the upload starts. My theory is that the quota of the uploading user is checked in the first case, even though the quota of the shared folder owner should be checked in both cases.

Steps to reproduce

1. Create two users: "joe", with small quota (1MiB) and "admin", with unlimited quota
2. "admin", shares a folder to "joe".
3. "joe" uses the web interface to log in. In the home screen, he drags a large file (>1M) on the folder shared to him by "admin". A message "Not enough free storage" is displayed.
4. "joe" now opens the shared folder and drags the file into the web interface now. File upload works

Expected behaviour

The file should be uploaded, because the shared folder belongs to "admin" and not to the quota of "joe", regardless of whether "joe" drags the file onto the folder symbol or opens the folder and drags the file inside afterwards.

Actual behaviour

A "Not enough storage" error is displayed to "joe", and he can't upload the file, if he drags the file onto the folder symbol.

Server configuration

Operating system: Arch Linux

Web server: Apache 2.4.25

Database: MariaDB 10.1.24

PHP version: 7.1.6

Nextcloud version: 12.0.0

Updated from an older Nextcloud/ownCloud or fresh install: fresh install

Where did you install Nextcloud from: From Nextcloud homepage

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:

• activity: 2.5.2
• bruteforcesettings: 1.0.2
• comments: 1.2.0
• dav: 1.3.0
• federatedfilesharing: 1.2.0
• federation: 1.2.0
• files: 1.7.2
• files_pdfviewer: 1.1.1
• files_sharing: 1.4.0
• files_texteditor: 2.4.1
• files_trashbin: 1.2.0
• files_versions: 1.5.0
• files_videoplayer: 1.1.0
• firstrunwizard: 2.1
• gallery: 17.0.0
• logreader: 2.0.0
• lookup_server_connector: 1.0.0
• nextcloud_announcements: 1.1
• notifications: 2.0.0
• oauth2: 1.0.5
• password_policy: 1.2.2
• provisioning_api: 1.2.0
• serverinfo: 1.2.0
• sharebymail: 1.2.0
• survey_client: 1.0.0
• systemtags: 1.2.0
• theming: 1.3.0
• twofactor_backupcodes: 1.1.1
• updatenotification: 1.2.0
• workflowengine: 1.2.0
  Disabled:
• admin_audit
• encryption
• files_external
• user_external
• user_ldap

Nextcloud configuration:

Config report

{
"system": {
        "instanceid": "oc21fut1jvx3",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost"
        ],
        "datadirectory": "\/srv\/http\/nextcloud\/data",
        "overwrite.cli.url": "http:\/\/localhost\/nextcloud",
        "dbtype": "mysql",
        "version": "12.0.0.29",
        "dbname": "nextcloud",
        "dbhost": "localhost",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true
    }
}

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: Firefox 53.0.3 (64-bit)

Operating system: Arch Linux

Logs

Web server error log

Web server error log

-- No error logged --

Nextcloud log (data/nextcloud.log)

Nextcloud log

-- no error logged --

Browser log

Browser log

-- no log entries added --

[mlell]

I tracked the problem down to the file apps/files/js/file-upload.js.
Line 836ff. (commit 8267e5e007109e979311784e62502012b1e0d4fd) says:

freeSpace = $('#free_space').val();
if (freeSpace >= 0 && selection.totalBytes > freeSpace) {
data.textStatus = 'notenoughspace';
data.errorThrown = t('files',
     'Not enough free space, you are uploading {size1} but only {size2} is left', {
          'size1': humanFileSize(selection.totalBytes),
      'size2': humanFileSize($('#free_space').val())
     });
}

In Firefox Debugger (F12), select "Javascript", type "Ctrl+F" and enter for example "!Not enough free space" (! stands for "search all javascript files") to find and set a breakpoint at that code, the live name of the script is different.

So the remaining free space is obtained from an invisible <input type='hidden' id='free_space' ... > object, as can be seen when searching the HTML tree for free_space.

However, this input is set by the current working folder, not the target of the upload. Can someone give me a hint about how to find out during execution of the above mentioned code, how to access the quota of the folder which is the target of the upload?

[MorrisJobke]

cc @nextcloud/sharing @nextcloud/javascript

[rullzer]

@mlell you'll need to do a propfind to the target folder to obtain the quota.

[mlell]

The attached patch fixes the problem. Apply it on apps/js/file-upload.js, commit 69d2d0178.
There are still problems, however, which is why I don't think it's ready for a pull request and I would be grateful about your feedback. 'debug' => true must be set in config/config.php to disable Javascript minification.

• I determine the upload target folder name by upload._targetFolder, which looks like a private function name
• I do the PROPFIND by OC.Files.getClient()._client.propFind(...), which looks hacky to me

Patch v2 (execute patch -p1 in the nextcloud base dir and paste this code on stdin):

Details

diff --git a/apps/files/js/file-upload.js b/apps/files/js/file-upload.js
index b86b42bdb..210d62835 100644
--- a/apps/files/js/file-upload.js
+++ b/apps/files/js/file-upload.js
@@ -833,56 +833,84 @@ OC.Uploader.prototype = _.extend({
 					}
 
 					// check free space
-					freeSpace = $('#free_space').val();
-					if (freeSpace >= 0 && selection.totalBytes > freeSpace) {
-						data.textStatus = 'notenoughspace';
-						data.errorThrown = t('files',
-							'Not enough free space, you are uploading {size1} but only {size2} is left', {
-							'size1': humanFileSize(selection.totalBytes),
-							'size2': humanFileSize($('#free_space').val())
-						});
-					}
+					davClient = OC.Files.getClient();
+					targetFolder = upload._targetFolder;
+					p = davClient._client.propFind(davClient._buildUrl(targetFolder));
+
+					p.then(function(f){
+						if(f.status < 200 || f.status >= 300){
+							return $.Deferred().reject({
+								textStatus: 'quotaqueryfailed',
+								message: t('files', 'HTTP Status {s} while querying free space on {t}',
+									{s: f.status, t:targetFolder})});
+						}
+						s = f.xhr.responseXML.getElementsByTagName("d:quota-available-bytes")[0].textContent
+						freeSpace = parseInt(s);
+						return $.Deferred().resolve(freeSpace);
+
+					}).then(function(freeSpace){
+						if (freeSpace >= 0 && selection.totalBytes > freeSpace) {
+							ts = 'notenoughspace';
+							m = t('files',
+								'Not enough free space, you are uploading {size1} but only {size2} is left', {
+								'size1': humanFileSize(selection.totalBytes),
+								'size2': humanFileSize(freeSpace)
+							});
+							return $.Deferred().reject({textStatus:ts, message:m});
+						}
+						return $.Deferred().resolve();
+
+					}).then(function(){
+						// check existing files when all is collected
+						if ( selection.uploads.length >= selection.filesToUpload ) {
+
+							//remove our selection hack:
+							delete data.originalFiles.selection;
+
+							var callbacks = {
+
+								onNoConflicts: function (selection) {
+									self.submitUploads(selection.uploads);
+								},
+								onSkipConflicts: function (selection) {
+									//TODO mark conflicting files as toskip
+								},
+								onReplaceConflicts: function (selection) {
+									//TODO mark conflicting files as toreplace
+								},
+								onChooseConflicts: function (selection) {
+									//TODO mark conflicting files as chosen
+								},
+								onCancel: function (selection) {
+									$.each(selection.uploads, function(i, upload) {
+										upload.abort();
+									});
+								}
+							};
+
+							self.checkExistingFiles(selection, callbacks);
 
-					// end upload for whole selection on error
-					if (data.errorThrown) {
+						}
+
+					}).then(null, function(err){
+						// This function is called if any of the above then()
+						// functions return a reject()ed Deferred object.
+						if(err instanceof Error){
+							// Called if a bug upstream in the then()-chain
+							// causes an Error to be thrown
+							data.errorThrown = err.name + ": " + err.message;
+							data.textStatus = "exceptionwhileupload";
+						}else{
+							// Called if a condition occurs upstream in the then()-chain
+							// which shall lead to a customized user message
+							data.textStatus = err.textStatus;
+							data.errorThrown = err.message;
+						}
+						// end upload for whole selection on error
 						// trigger fileupload fail handler
 						var fu = that.data('blueimp-fileupload') || that.data('fileupload');
 						fu._trigger('fail', e, data);
-						return false; //don't upload anything
-					}
-
-					// check existing files when all is collected
-					if ( selection.uploads.length >= selection.filesToUpload ) {
-
-						//remove our selection hack:
-						delete data.originalFiles.selection;
-
-						var callbacks = {
-
-							onNoConflicts: function (selection) {
-								self.submitUploads(selection.uploads);
-							},
-							onSkipConflicts: function (selection) {
-								//TODO mark conflicting files as toskip
-							},
-							onReplaceConflicts: function (selection) {
-								//TODO mark conflicting files as toreplace
-							},
-							onChooseConflicts: function (selection) {
-								//TODO mark conflicting files as chosen
-							},
-							onCancel: function (selection) {
-								$.each(selection.uploads, function(i, upload) {
-									upload.abort();
-								});
-							}
-						};
-
-						self.checkExistingFiles(selection, callbacks);
-
-					}
-
-					return true; // continue adding files
+					});
 				},
 				/**
 				 * called after the first add, does NOT have the data param

[rullzer]

@mlell awesome that you started!

please do create a PR that way other engineers can hack together with you on a solution :)

[szaimen]

I'm closing this issue due to inactivity. If this is still happening please make sure to upgrade to the latest version. After that, feel free to reopen.