EnterpriseyIntranet / nextcloud-API

NextCloud OCS API for Python
GNU General Public License v3.0
27 stars 27 forks source link

Didn't found any way to list files of others users #68

Open luffah opened 3 years ago

luffah commented 3 years ago

In methods list_folders, you can specify the user, therefore an altenative user, but i did'nt have any success using this. To have this not working is not so bad... it could imply many security issues.

    def list_folders(self, uid, path=None, depth=1, all_properties=False):
        """
        Get path files list with files properties for given user, with given depth

        Args:
 --->       uid (str): uid of user     <---
            path (str/None): files path
            depth (int): depth of listing files (directories content for example)
            all_properties (bool): list all available file properties in Nextcloud
        """
    ...
    # therefore many requests occur to be...
    nxc.list_folder(nxc.user, '/')
    #  if alternative user can't be explored, it may be simpler to do
    nxc.list_folder('/')
luffah commented 3 years ago

Tested with curl:

getfiles.xml

<?xml version="1.0" encoding="UTF-8"?>
<d:propfind
    xmlns:d="DAV:"
    xmlns:oc="http://owncloud.org/ns"
    xmlns:nc="http://nextcloud.org/ns">
    <d:prop>
        <oc:id />
        <oc:fileid />
    </d:prop>
</d:propfind>

_curl(){
echo "<!-- $* -->"
curl --silent \
-k \
-X $1 \
--data "$2" \
-u ${NC_USER}:${NC_USER_PWD} \
"$3" | xmllint --format -
}
# let's assume to ease example that passwords are the same for all user
NC_USER=ncadmin
_curl PROPFIND @getfiles.xml $NC_DAV_URL/files/${NC_USER}  
# ->  <d:status>HTTP/1.1 200 OK</d:status>

NC_USER=test _curl PROPFIND @getfiles.xml $NC_DAV_URL/files/${NC_USER}

-> HTTP/1.1 200 OK</d:status>

NC_USER=ncadmin _curl PROPFIND @getfiles.xml $NC_DAV_URL/files/test

-> HTTP/1.1 404 Not Found</d:status>