Folder Protection - Releases

Fixed

• A protected folder reserved its name across the whole server. With /files/a/b/gama protected, no user could create a folder called gama anywhere — MKCOL /files/gama returned 403. This was documented as a known limitation up to v2.1.0 and believed fixed in v2.2.0: 9363b42 removed the isAnyProtectedWithBasename heuristic from StorageWrapper and the README line was dropped. But the same heuristic had been added to ProtectionPlugin::beforeBind three months earlier, for a different purpose, and was never removed — and DAV is the path both Explorer and the web UI use, so the limitation survived in full while no longer being documented. The beforeBind block is now gone; protection is genuinely path-based again.

• Rejecting a desktop-client move left an empty folder at the destination. This is what the server-wide name block was really guarding against: the Windows client sends MKCOL destination before MOVE, so refusing the move stripped nothing back out. beforeMove already had a deleteEmptyNode() call for it, but that code was unreachable — Sabre emits beforeUnbind for the move source before beforeMove, and a protected source aborts the request there. The cleanup now runs from beforeUnbind via cleanUpMoveSteppingStone(), which reads the Destination header when the request method is MOVE. The orphan is removed for the one folder involved, instead of every user being denied the name.

• Deleting the parent of a protected folder broke desktop sync unrecoverably. Deleting the protected folder itself was fine — it came straight back — but deleting an ancestor left the client in a sync error that only a manual re-copy cleared.

What makes the direct case work is not a retry, it is that the client never attempts the delete: ProtectionPropertyPlugin strips D from oc:permissions, so the folder is advertised as non-deletable and the client restores it locally. That strip was keyed on isProtected() — an exact match — so an ancestor still advertised RGDNVCK. The client deleted it, hit the 403 that beforeUnbind raises for a protected descendant, and had nowhere to go. Both the property plugin and StorageWrapper::getPermissions() now strip D when hasProtectedDescendant() is true as well, so the whole ancestor chain is advertised as non-deletable and matches what the server actually enforces.

beforeUnbind additionally calls touchSubtree() in this case, giving the subtree fresh etags (bounded at 10000 entries) so a client that already removed the contents locally pulls them back rather than reading them as a deletion to propagate.

• The "Move or copy" entry stayed visible in a protected folder's row menu. The selector looked for action id copy; Nextcloud's id is move-copy — the same one the selection bar was already matching correctly. Delete was hidden, copy was not, so the action was clickable and only failed once a destination had been picked.

• Notifications never reached the user. The notifier was declared only through an <notifications><notifier> block in appinfo/info.xml. That element is not read by the server and does not exist in the App Store info.xsd — no core app uses it; they all call registerNotifierService(). The notifier was therefore absent from RegistrationContext::getNotifierServices(), so every "action blocked" notification was created and then discarded in Notification\Manager::prepare(). Application::register() now calls $context->registerNotifierService().

• occ folder-protection:protect had no effect for up to 300 seconds. The command inserted the row and returned success, but never invalidated the protection cache the way AdminController::protect() does. isProtected() caches negative results for 300s, and any earlier PROPFIND or MKCOL on the path will have populated it — so a folder protected from the CLI could still be deleted or moved straight afterwards. Both Protect and Unprotect now call clearCacheForPath(). Found by testing on NC 34; it affected NC 33 identically.

Note the fix only holds where memcache.distributed is configured (Redis or similar). Falling back to APCu means the CLI and Apache have separate caches and no invalidation from a command can reach the web process — see build/README.md.

• occ folder-protection:unprotect was unusable from a script. Its confirmation prompt resolves to its default under -n/--no-interaction, and that default is "no" — so the command printed Cancelled. and exited 0, reporting success while having done nothing. It now takes --force to confirm non-interactively, and refuses with exit code 1 rather than pretending to have run. Piping an answer (echo y | occ …) still works.

Security

• Removed #[NoCSRFRequired] from the state-changing POST endpoints (protect, unprotect, updateReason, clearCache). The attribute disables the CSRF check for all HTTP methods, so an authenticated admin visiting a malicious page could have folders protected or unprotected cross-site. Read-only GETs keep the attribute. The frontend uses @nextcloud/axios, which sends the request token automatically.
• Removed the #[AdminRequired] attribute and its import. No such attribute exists in Nextcloud (only NoAdminRequired and SubAdminRequired); it was silently inert. The endpoints were in fact protected, because admin-only is the default in SecurityMiddleware::checkSecurity — but the attribute suggested a guarantee it never provided, and the use statement pointed at a non-existent class.

Changed

• hasProtectedDescendant() answers from the cached protection list instead of running a COUNT(*) with a LIKE. It is now called once per node on every PROPFIND, where a query per listed file was not affordable. The cached list is already invalidated by clearCacheForPath() on every protect/unprotect, so it is no more stale than isProtected(). Comparing in PHP also drops the LIKE wildcard escaping, where an unescaped _ in a folder name matched any character.

• Nextcloud 34 compatibility: max-version raised to 34, min-version to 33, and the PHP requirement to 8.3 (NC 34 requires 8.3+; 8.2 is deprecated).

• Removed the <dav><properties> and <notifications> blocks from info.xml. Neither is a valid element in the App Store schema and neither is parsed by the server; both would fail XSD validation on upload. The DAV properties are registered by DAV\ProtectionPropertyPlugin.
• folder-protection-ui.js is now bundled by webpack from src/ and imports generateUrl from @nextcloud/router instead of using the deprecated OC.generateUrl global.
• AdminApp.vue uses translate from @nextcloud/l10n instead of the deprecated OC.L10N.translate global.
• Aligned package.json with its declared dependency versions (@nextcloud/l10n was pinned at 1.6.0 on disk while the manifest asked for ^3.4.1) and with the info.xml version number.
• Reordered info.xml: its elements are an xs:sequence, and <dependencies> sat before <website> while <admin> sat after <admin-section>. Both violated the schema, so the file had never validated and the app could not have been uploaded to the App Store.
• Added build/docker-compose.nc34.yml and build/README.md — a disposable NC 34 instance (port 8085) that verifies the declared max-version instead of assuming it. Verified there: 23/23 unit and 14/14 integration on NC 34.0.2 / PHP 8.5.8.
• Dropped the deprecated curl_close() from the integration tests; PHP 8.5, which NC 34 ships, warns on it and it has been a no-op since 8.0.

Note

• The 2.3.0 entry below claims IResult::fetch() was "removed in NC33". That is incorrect — fetch() is @since 21.0.0 and is still present in NC 33 and 34, carrying only a @note recommending fetchAssociative()/fetchNumeric(). It is not deprecated. Conversely, fetchAssociative() is @since 33.0.0 and does not exist in NC 32 or earlier.

Fixed

• Notifier registration corrected to prevent startup warnings
• Lock path resolution fixed for edge cases in LockPlugin
• COPY operation now correctly blocks descendants of protected folders, not just the root
• Removed dead code paths in protection check flow

Changed

• Admin UI: added edit button to update the protection reason inline
• Admin UI: lock icon overlay on folder entries, styled confirmation dialog (replaces browser native confirm), "Configurações" section label, internal ID shown as monospace chip, reason displayed with label
• Translations: added missing strings for en/pt_PT (lock icon toggle, folder existence check, edit reason)

Fixed

• Notifier registration corrected to prevent startup warnings
• Lock path resolution fixed for edge cases in LockPlugin
• COPY operation now correctly blocks descendants of protected folders, not just the root
• Removed dead code paths in protection check flow

Changed

• Admin UI: added edit button to update the protection reason inline
• Admin UI: lock icon overlay on folder entries, styled confirmation dialog (replaces browser native confirm), "Configurações" section label, internal ID shown as monospace chip, reason displayed with label
• Translations: added missing strings for en/pt_PT (lock icon toggle, folder existence check, edit reason)

Fixed

• Notifier registration corrected to prevent startup warnings
• Lock path resolution fixed for edge cases in LockPlugin
• COPY operation now correctly blocks descendants of protected folders, not just the root
• Removed dead code paths in protection check flow

Changed

• Admin UI: added edit button to update the protection reason inline
• Admin UI: lock icon overlay on folder entries, styled confirmation dialog (replaces browser native confirm), "Configurações" section label, internal ID shown as monospace chip, reason displayed with label
• Translations: added missing strings for en/pt_PT (lock icon toggle, folder existence check, edit reason)

Fixed

• Notifier registration corrected to prevent startup warnings
• Lock path resolution fixed for edge cases in LockPlugin
• COPY operation now correctly blocks descendants of protected folders, not just the root
• Removed dead code paths in protection check flow

Changed

• Admin UI: added edit button to update the protection reason inline
• Admin UI: lock icon overlay on folder entries, styled confirmation dialog (replaces browser native confirm), "Configurações" section label, internal ID shown as monospace chip, reason displayed with label
• Translations: added missing strings for en/pt_PT (lock icon toggle, folder existence check, edit reason)

Fixed

• Notifier registration corrected to prevent startup warnings
• Lock path resolution fixed for edge cases in LockPlugin
• COPY operation now correctly blocks descendants of protected folders, not just the root
• Removed dead code paths in protection check flow

Changed

• Admin UI: added edit button to update the protection reason inline
• Admin UI: lock icon overlay on folder entries, styled confirmation dialog (replaces browser native confirm), "Configurações" section label, internal ID shown as monospace chip, reason displayed with label
• Translations: added missing strings for en/pt_PT (lock icon toggle, folder existence check, edit reason)