List of shares is incomplete after reshare

[PVince81]

Not sure whether bug or feature:

Steps

1. Create three users: user1, user2 and user3
2. Login as "user1"
3. Create a subdir "sharethis"
4. Share "sharethis" with "user2".
5. Login as "user2"
6. Share "sharethis" with "user3".
7. Login as "user1"
8. Click on the "Share" button of "sharethis" to see the list of shared users

Expected result

List of shared users contains "user2" and "user3" (reshare)

Actual result

List of shared users only contain "user2".

Furthermore, you can do funny things: login as "user3" and share "sharethis" with "user1". Then login as "user1" and you'll see "sharethis" in the root and also in the "Shared" subdir.

Is this "chain of trust" by design ?

Should the "list of shared users" be replaced by a different concept which could be called "who has access ?"

If "user1" sees that the subdir was shared with "user3" as well then the user could decide to remove that share later. Currently, "user1" can only revoke the share from "user2" to indirectly prevent "user3" to access it.

@karlitschek @DeepDiver1975 @schiesbn @jancborchardt

[schiessle]

The first point is intended. The drop-down should show with whom you shared a file and let you edit your shares.

The second point is probably a bug. We shouldn't allow to share a file back. Afaik sharing back from user3 to user2 is already blocked. So we just need to make this check smarter.

[jancborchardt]

The thing here is that we currently have a »reshare« model. I would agree
with you @PVince81 that a »everyone can share the file on the same level«
model would be better than a chain. Then everyone in that share should have
the same list of shared people shown. It’s way simpler, and I don’t think
it would make us lose any important functionality. @MTRichards?

[karlitschek]

I would strongly suggest to keep it simple and not introduce any more clever complexity to the sharing. :-) Number one priority has performance, bugs and the already discuss feature enhancements :-)

[PVince81]

Should we close this as parts of it might be reconsidered in #4437 ?

[jancborchardt]

Yeah, let’s do that. But let’s really do that then.