{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/15097","labels_url":"https://api.github.com/repos/owncloud/core/issues/15097/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/15097/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/15097/events","html_url":"https://github.com/owncloud/core/issues/15097","id":63582179,"number":15097,"title":"Data leak using orphaned share-over-link","user":{"login":"schwerpunkt","id":2730611,"avatar_url":"https://avatars.githubusercontent.com/u/2730611?v=3","gravatar_id":"","url":"https://api.github.com/users/schwerpunkt","html_url":"https://github.com/schwerpunkt","followers_url":"https://api.github.com/users/schwerpunkt/followers","following_url":"https://api.github.com/users/schwerpunkt/following{/other_user}","gists_url":"https://api.github.com/users/schwerpunkt/gists{/gist_id}","starred_url":"https://api.github.com/users/schwerpunkt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schwerpunkt/subscriptions","organizations_url":"https://api.github.com/users/schwerpunkt/orgs","repos_url":"https://api.github.com/users/schwerpunkt/repos","events_url":"https://api.github.com/users/schwerpunkt/events{/privacy}","received_events_url":"https://api.github.com/users/schwerpunkt/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/owncloud/core/labels/Privacy","name":"Privacy","color":"e11d21"},{"url":"https://api.github.com/repos/owncloud/core/labels/regression","name":"regression","color":"e11d21"},{"url":"https://api.github.com/repos/owncloud/core/labels/sharing","name":"sharing","color":"e102d8"}],"state":"open","locked":false,"assignee":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2015-03-22T22:17:11Z","updated_at":"2015-03-23T14:52:50Z","closed_at":null,"body":"### Steps to reproduce\r\n\r\nI was not able to reproduce it so far.\r\nIt might have been a relict of the OC7 => OC8 upgrade.\r\n\r\nStill there is a deep security/data leak issue:\r\n\r\nI had shared a file with the share over link function in OC (I think it was the latest version of OC7) on my website a few weeks ago.\r\nLater I unshared the file (I can't recall doing it through the webinterface or a mobile app or whether I just deleted the file).\r\n\r\nToday I clicked the link that I still had on my website and unexpectedly an endless stream of data was downloaded from my OC (a download.zip accessed by a link that earlier had pointed to a shared picture).\r\n\r\nI downloaded up to 3GB of that stream before I killed my apache out of fear.\r\nThe download.zip in the HEX editor showed terrifyingly my folder structure as well as all the files' contents.\r\n\r\nThe orphaned token of the shared link was still in the oc_share table of my database.\r\n\r\n### Expected behaviour\r\n\r\nInvalid share-link should display a missing file / error message.\r\n\r\nOrphaned shared links should not exist.\r\n\r\n### Actual behaviour\r\n\r\nA whole stream of all my OC-users data was downloaded in a download.zip-file.\r\n\r\n### Server configuration\r\n**Operating system**:\r\n\r\nUbuntu 12.04\r\n\r\n**Web server:**\r\n\r\nApache/2.4.12 (Ubuntu)\r\n\r\n**Database:**\r\n\r\nmysql  Ver 14.14\r\n\r\n**PHP version:**\r\n\r\nPHP 5.5.22-1+deb.sury.org~precise+1\r\n\r\n**ownCloud version:** (see ownCloud admin page)\r\n\r\n8.0.2.0\r\n\r\n**Updated from an older ownCloud or fresh install:**\r\n\r\nupdated from latest OC7\r\n\r\n**List of activated apps:**\r\n\r\nActivity, Calendar, Contacts, Deleted Files, External storage support, First Run Wizard, Mozilla Sync, PDF Viewer, Pictures, Share Files, Text Editor, Updater, Versions, Video Viewer\r\n\r\n**The content of config/config.php:**\r\n\r\n```\r\n<?php\r\n$CONFIG = array (\r\n  'instanceid' => '---',\r\n  'passwordsalt' => '---',\r\n  'datadirectory' => '---',\r\n  'dbtype' => 'mysql',\r\n  'version' => '8.0.2.0',\r\n  'dbname' => 'owncloud',\r\n  'dbhost' => 'localhost',\r\n  'dbtableprefix' => 'oc_',\r\n  'dbuser' => '---',\r\n  'dbpassword' => '---',\r\n  'installed' => true,\r\n  'theme' => '',\r\n  'maintenance' => false,\r\n  'overwritewebroot' => '/owncloud',\r\n  'overwrite.cli.url' => '/owncloud',\r\n  'trusted_domains' => \r\n  array (\r\n    0 => '---',\r\n    1 => '---',\r\n  ),\r\n  'secret' => '---',\r\n  'loglevel' => 1,\r\n);\r\n\r\n```\r\n\r\n\r\n\r\n**Are you using external storage, if yes which one:** local/smb/sftp/...\r\n\r\nsmb\r\n\r\n**Are you using encryption:** yes/no\r\n\r\nno\r\n\r\n**Are you using an external user-backend, if yes which one:** \r\n\r\nnone"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/85034868","html_url":"https://github.com/owncloud/core/issues/15097#issuecomment-85034868","issue_url":"https://api.github.com/repos/owncloud/core/issues/15097","id":85034868,"user":{"login":"thedd","id":1588661,"avatar_url":"https://avatars.githubusercontent.com/u/1588661?v=3","gravatar_id":"","url":"https://api.github.com/users/thedd","html_url":"https://github.com/thedd","followers_url":"https://api.github.com/users/thedd/followers","following_url":"https://api.github.com/users/thedd/following{/other_user}","gists_url":"https://api.github.com/users/thedd/gists{/gist_id}","starred_url":"https://api.github.com/users/thedd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thedd/subscriptions","organizations_url":"https://api.github.com/users/thedd/orgs","repos_url":"https://api.github.com/users/thedd/repos","events_url":"https://api.github.com/users/thedd/events{/privacy}","received_events_url":"https://api.github.com/users/thedd/received_events","type":"User","site_admin":false},"created_at":"2015-03-23T14:52:50Z","updated_at":"2015-03-23T14:52:50Z","body":"I can reproduce this:\r\n>I also noticed: when I have sharing enabled and I am logged in, I can download this download.zip containing all my data when accessing https://link.to/owncloud/index.php/s/anytokenpossible/download.\r\nIt's another issue that's not as critical, but should probably still get fixed."}}