nextcloud
[Bug]: Creating group "disabled" is allowed but conflicts with the built-in disabled users group
⚠️ This issue respects the following points: ⚠️
- [X] This is a bug, not a question or a configuration/webserver/proxy issue.
- [X] This issue is not already reported on Github (I've searched it).
- [X] Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- [X] Nextcloud Server is running on 64bit capable CPU, PHP and OS.
- [X] I agree to follow Nextcloud's Code of Conduct.
Bug description
Creating a new user group with the name "disabled" can be created and stands in the place of the disabled users menu entry and shows (in my case admin as a disabled user even when it is not and cannot be disabled). No disabled users are shown there and the "disabled" group has to be removed via occ group:delete disabled .
Steps to reproduce
- Add group with the name "disabled"
- Navigate to the Disabled users menu
- Admin should be there but no actual disabled users
Expected behavior
Creating a group with the name "disabled" should not be allowed
Installation method
Official All-in-One appliance
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.0
Web server
Apache (supported)
Database engine version
PostgreSQL
Is this bug present after an update or on a fresh install?
Fresh Nextcloud Server install
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
- [X] Default user-backend (database)
- [ ] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other
Configuration report
{
"system": {
"memcache.local": "\\OC\\Memcache\\APCu",
"apps_paths": [
{
"path": "\/var\/www\/html\/apps",
"url": "\/apps",
"writable": false
},
{
"path": "\/var\/www\/html\/custom_apps",
"url": "\/custom_apps",
"writable": true
}
],
"memcache.distributed": "\\OC\\Memcache\\Redis",
"memcache.locking": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"password": "***REMOVED SENSITIVE VALUE***",
"port": 6379
},
"overwritehost": "REMOVED",
"overwriteprotocol": "https",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"localhost",
"*"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "pgsql",
"version": "25.0.3.2",
"overwrite.cli.url": "https:\/\/REMOVED\/",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"instanceid": "***REMOVED SENSITIVE VALUE***",
"loglevel": "2",
"log_type": "file",
"logfile": "\/var\/www\/html\/data\/nextcloud.log",
"log_rotate_size": "10485760",
"log.condition": {
"apps": [
"admin_audit"
]
},
"preview_max_x": "2048",
"preview_max_y": "2048",
"jpeg_quality": "60",
"enabledPreviewProviders": {
"1": "OC\\Preview\\Image",
"2": "OC\\Preview\\MarkDown",
"3": "OC\\Preview\\MP3",
"4": "OC\\Preview\\TXT",
"5": "OC\\Preview\\OpenDocument",
"6": "OC\\Preview\\Movie",
"0": "OC\\Preview\\Imaginary"
},
"enable_previews": true,
"upgrade.disable-web": true,
"mail_smtpmode": "smtp",
"trashbin_retention_obligation": "auto, 30",
"versions_retention_obligation": "auto, 30",
"activity_expire_days": "30",
"simpleSignUpLink.shown": false,
"share_folder": "\/Shared",
"tempdirectory": "\/mnt\/ncdata\/tmp\/",
"one-click-instance": true,
"one-click-instance.user-limit": 100,
"one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
"htaccess.RewriteBase": "\/",
"files_external_allow_create_new_local": false,
"trusted_proxies": "***REMOVED SENSITIVE VALUE***",
"allow_local_remote_servers": true,
"preview_imaginary_url": "http:\/\/nextcloud-aio-imaginary:9000",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_sendmailmode": "smtp",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtpauthtype": "LOGIN",
"mail_smtpauth": 1,
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"mail_smtpport": "587",
"mail_smtpname": "***REMOVED SENSITIVE VALUE***",
"mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
}
}
List of activated Apps
Enabled:
- activity: 2.17.0
- admin_audit: 1.15.0
- calendar: 4.2.1
- circles: 25.0.0
- cloud_federation_api: 1.8.0
- comments: 1.15.0
- contacts: 5.0.3
- contactsinteraction: 1.6.0
- dashboard: 7.5.0
- dav: 1.24.0
- deck: 1.8.3
- drawio: 2.1.0
- federatedfilesharing: 1.15.0
- federation: 1.15.0
- files: 1.20.1
- files_fulltextsearch: 25.0.0
- files_pdfviewer: 2.6.0
- files_rightclick: 1.4.0
- files_sharing: 1.17.0
- files_trashbin: 1.15.0
- files_versions: 1.18.0
- firstrunwizard: 2.14.0
- fulltextsearch: 25.0.0
- fulltextsearch_elasticsearch: 25.0.0
- groupfolders: 13.1.0
- logreader: 2.10.0
- lookup_server_connector: 1.13.0
- nextcloud-aio: 0.3.0
- nextcloud_announcements: 1.14.0
- notes: 4.6.0
- notifications: 2.13.1
- notify_push: 0.5.2
- oauth2: 1.13.0
- onlyoffice: 7.6.8
- password_policy: 1.15.0
- passwords: 2023.1.13
- photos: 2.0.1
- privacy: 1.9.0
- provisioning_api: 1.15.0
- recognize: 3.3.6
- recommendations: 1.4.0
- registration: 2.0.0
- related_resources: 1.0.3
- serverinfo: 1.15.0
- settings: 1.7.0
- sharebymail: 1.15.0
- spreed: 15.0.3
- support: 1.8.0
- survey_client: 1.13.0
- systemtags: 1.15.0
- tasks: 0.14.5
- text: 3.6.0
- theming: 2.0.1
- twofactor_backupcodes: 1.14.0
- twofactor_totp: 7.0.0
- user_migration: 2.0.1
- user_status: 1.5.0
- viewer: 1.9.0
- weather_status: 1.5.0
- workflowengine: 2.7.0
Disabled:
- bruteforcesettings
- encryption
- files_external
- suspicious_login
Nextcloud Signing status
No response
Nextcloud Logs
No response
Additional info
No response
Reproduced in NC26.
We don't actually use the group disabled internally in the backend to indicate disabled users, but the frontend seems to look for a disabled group in the same way as it does for the internal admin group:
https://github.com/nextcloud/server/blob/6cb75e8bf59e06b14734ad31e37d7707c2a2a281/apps/settings/src/views/Users.vue#L306-L320
So if one gets added... a new code path gets used and this situation pops up. The frontend must also be finding enabled users the proper way somewhere or groups wouldn't work at all right now.
The frontend shouldn't be treating membership in a group called disabled as special. User state is determined solely by user: { enabled: true/false } rather than via group membership (i.e. an enabled user can be a member in an arbitrary group called disabled).
This issue doesn't exist for the admin group because it's actually a real group and it membership in it actually indicates something.
