Skip to content

Shares drive can be shared via link share with Internal role using permissions endpoint #11409

@saw-jan

Description

@saw-jan

Describe the bug

When using the permissions endpoint, link share of Shares drive with Internal role can be created. THis should not be possible.
NOTE: with root endpoint, this is not possible.

Steps to reproduce

  1. Create a link share of Shares drive with Internal role - (❗should not be possible)
    API: https://owncloud.dev/libre-graph-api/#/drives.permissions/CreateLink
curl -XPOST 'https://localhost:9200/graph/v1beta1/drives/<shares-drive-id>/items/a0ca6a90-a365-4782-871e-d44447bbc668$a0ca6a90-a365-4782-871e-d44447bbc668!a0ca6a90-a365-4782-871e-d44447bbc668/createLink' \
-d'{"type":"internal","@libre.graph.quickLink":false,"displayName":null,"expirationDateTime":null,"password":null}' \
-uadmin:admin -vk | jq
< HTTP/1.1 200 OK
{
  "createdDateTime": "2025-06-09T08:35:05.027007478Z",
  "hasPassword": false,
  "id": "RzoSVlBEeUVYUVu",
  "link": {
    "@libre.graph.displayName": "",
    "@libre.graph.quickLink": false,
    "preventsDownload": false,
    "type": "internal",
    "webUrl": "https://localhost:9200/s/xqvNlmOGVYpjjUJ"
  }
}
  1. try to access the link webUrl - link doesn't work

Image

Expected behavior

400 with error:

{
  "error": {
    "code": "invalidRequest",
    "innererror": {
      "date": "2025-06-09T08:37:41Z",
      "request-id": "sawjan-optiplex/390j8jTAqD-001876"
    },
    "message": "cannot create link on shares space root"
  }
}

Actual behavior

200 with link

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions