Make sharing permission defaults configurable

[pmaier1]

We should switch to a more conservative policy in these regards.

This will prevent users from unintentionally giving more permissions on shares as needed. Users will have to consciously decide which additional permissions a recipient should have.
Will also tackle the issue that there always is a short time frame after sharing a file where all permissions are given #11707.

I hope this is not a duplicate, could not find anything during a quick search.

@felixboehm @PVince81 Please find an assignment for this for 10.0.3.

Edit:
Had another discussion and decided that changing defaults hardcoded is too big of a step. This means that we also need it configurable in the first step.
For this a config switch with the following options would be minimum.

• all (default; -> as it is today)
• read-only

Depending on efforts setting granular defaults would be nice of course.

[PVince81]

@pmaier1 duplicate of #11707, I found easily because I knew it existed 😉

As long as something is in backlog and not planned it doesn't make much sense to find an assignment.

[pmaier1]

Yep, I thought to untangle the issue in smaller steps to make it easier to have a first step in 10.0.3 but it turned out that just changing defaults would not be a good idea which is why I edited with a minimum approach to make at least "extremes" configurable. I also read #11707 but I thought this ticket is a possible solution to it.

As long as something is in backlog and not planned it doesn't make much sense to find an assignment.

If possible it would be good to plan the minimum approach for 10.0.3 which is why I asked to find an assignment.

[PVince81]

assigning self

[pmaier1]

• Add to admin docs
• Add a hint in the 'Hardening' guide

[PVince81]

@felixboehm you moved this to development, do you still consider this to be a topic for 10.0.3 ?

same question for @pmaier1

[PVince81]

Dev plan:

• add new checkbox in settings page under "Sharing" for the administrator: "[x] newly created local shares are read-write by default". The checkbox is ticked by default. If the admin unticks, then they will be read-only.
• adjust OCS API code to use that setting for its defaults
• (might not be required, need to test) pass the value to the JS side to properly set the default permissions
• expose default perms through capabilities API for clients

[PVince81]

for the above plan, estimate is 0.25-0.5 md