Allow public upload and show but not delete

Hi everyone,

is it somehow possible to realize a public (link, password protected) share to which multiple users who have the link and the password can upload files, which are not hidden and users are not allowed to delete them any more?

Background:
A folder should be created and shared via public link. A few Guests (lets say of a party) should be able to upload self-made pictures and watch all pictures uploaded but they may not delete them for preventing deletion of pictures someone other has uploaded.

(How) could that be achieved with nextcloud?

Thx for any hint!
Snoopy

2 Likes

Not directly I think. What you can try:

  • create a new user
  • share the supposed folder with that user, you can allow him to create now files/folder (but not to change or delete files)
  • then use this new user to create a share link

Thx for the hint, but that didn’ work. What I’ve done:

  1. Created a folder in user “admin”
  2. Shared this folder with a second (non-admin) user, set rights to “create” but NOT “change” and “delete”
  3. logged out and logged in as this secound user
  4. Share the admin user - shared folder via link
  5. Wanted to set “Allow edit”, but get an error message:
    Error while sharing
    Cannot increase permissions

To verify I did this:

  1. Logged in as admin user
  2. Set rights of the shared folder to “create”, “change” and “delete” for the second user
  3. Logged in as the second user
  4. Share the admin user - shared folder via link
  5. Set “Allow edit”, this time without error
    But now the files could again be deleted and changed by public users…

Isn’t it possible to make rights - control (“delete”, “change”, “edit”) to public link shared folders similar to the user - shared folders?

1 Like

Yes it should be possible, therefore I changed this topic into a feature request. @rullzer is there a reason that these options are not available for shared links?

Any update on this?

It works for me: select “Allow upload and editing” and then choose “File drop (upload only)”

@tflidd:
For me, this doesn’t solve the problem. As u mentioned, I created a new empty Folder named “PublicShareTest”, activated “Share via Link” and “Allow upload and editing” together with “File drop (upload only)”.
Then I opened the Link, it shows an empty Folder (see: http://picpaste.com/pics/nextcloud2-qulZquBz.1493057855.png). Then I uploaded 3 Test Files (images). At the bottom one can then read, that these files were uploaded, but they aren’t really shown (see: http://picpaste.com/pics/nextcloud3-j1BfaVcW.1493057944.png). When one refreshes the site, the folder again seems to be empty and looks as in the first screenshot.
This is exactly the behavior I described above and works as assumed as a File drop only (just exactly as the option “File drop (upload only)” sais.

What I asked was:
How could a public share been created, to which other users who knows the link can upload files and create SubFolders, see and download all files that were uploaded (by others, too), but not edit or delete them. Think of some sort of public - uploadable foto album perhaps…

This is currently not possible. What I would do is create two links: One with File Drop (upload only) and another which is read only!

You can do this in Nextcloud 12, not in 11, but 12 is out next week - so, soon :wink:

1 Like

I do think a method to combine both in a single shared link would be good. As stated it could be used to make a central upload for example photo’s where people can then also download already uploaded photo’s but not delete them.

exactly what I meant…
why not implementing the same checkboxes (“can edit”,“can delete”…) for public links as it is already possible right now when sharing with other nextcloud users…

I don’t seem to be able to do that. Checked through apps for it just in case and combed through settings…

Just enter the mail address of the person you want to share to. Every mail address gets an unique link which you can configure to have file drop etc etc. See https://nextcloud.com/secure-drop/ for a video where I do it :wink:

Feature request: multiple links without having to assign email addresses :slight_smile:

1 Like

Yeah, that’s something we want to do. It needs work on the sharing dialog which we want to do but it ain’t easy. Right now we have a very simple, easy to use dialog and the designers like to avoid complicating it. At the same time, most other file sync & share software has a more complicated dialog (but same features!) with a popup and a separate ‘share’ button. That two-step sharing might be more than is needed but it is becoming what people are used to.

Moreover, the current way has some downsides that annoy our good security friends - for example, if you want to password-protect a share, you have to first share (!) and then add password protection. Now the short time between the sharing and adding a password doesn’t really allow much abuse and we have various protection features that make exploiting it very hard (brute force protection, rate limiting) but it is still less than ideal.

Anyhow - help welcome. If you have an idea of how the ability to create multiple links should look like, share it!

So something like this would be deemed too complicated?

Nah, might work. Just keep adding empty ‘share link’ things under.

I would also like to name links by just typing a different text (as long as it hasn’t been used yet) but that’s disliked by security & doesn’t work nicely on very large instances (everything will have been used at some point…)

Much like bit.ly and other services it’s inevitable, but then reuse is possible, if you don’t mind the security implications of that, too…

Mind you, it could also look like the user share dialogue, URL on the left, triple dots on the right with the permissions in the dropdown, but then simplicity is lost…

Mja, every link that’s made could turn into the one you now get when you create a mail link share… To not clutter the UI. @jan what do you think?

1 Like

I posted my feature request in german here also:

Another user found out, that the functionality already seems to work quit perfect, as he described in his answer:

He figured out, that it seems to be just enough to update the “permissions” database field of the responsible dataset of the “link-share” in the “…_share” table to the value “5”. Then the behaviour of the “link-share” is exactly what I asked for… upload files, create folders, download files / folders but NOT delete them.
Of course the Share GUI of the “link-shared” folder now is incorrect as it is not able to represent / display this state and editing the permissions in GUI overwrites the manual updated field in the database table.

As a result: am I right, that only the GUI had to be updated as the basic functionality works as expected?

1 Like

I wanna do something like this, actually, with nextcloud 13 , the only solution i found is

-Create a public share link with the read only
-Create other link shared with email than is a drop files only
-Take that link in the email and share it with my friends

now the can add files with a link and download with the other but can’t delete files

will be great have a unique link for this or even a way to “approve uploads” before can show in public folder