Nextcloud · Report #220385
Delete All Data of Any User
Validstatus
lowseverity
8upvotes
1 Mar 2020disclosed
How it was found
If you are user have permission manage user(admin group), you can delete all data off website. step:
- Create new user with username is '.'.
- Delete user, who just have been created.
Cause: when you create new use, nextcloud app will make a new folder same name with username, which have been created. in folder (sourceweb/data) Unfortunately, if username is '.', nextcloud app will make a new folder has name is '.'. And when you delete user, nextcloud app will remote all folder 'data'.