Bug: Folder inheritance doesn't work like expected


today we found a major error in the inheritance of folders.

How to reproduce the bug:

  1. Create a new folder “testdir1” with subfolders “testdir2” and “testdir3”
  2. In each folder create a test password (“testpw1”, “testpw2”, “testpw3”)
  3. Share the top folder “testdir1” with a user e.g. “testuser1” as “can read”
    –> Now everything below “testdir1” is shared as read-only with “testuser1” ( “testpw1”, “testpw2” and “testpw3” ) like expected
  4. Change the permissions for “testuser1” on the top folder “testdir1” to “can update”
    Expectation: The change is inherited from “testdir1” to “testdir2” and “testdir3” including all passwords ( “testpw1”, “testpw2” and “testpw3” )
    Reality: The update is only performed on “testdir1” and “testpw1”. “testdir2” and “testdir3” with the passwords ( “testpw2” and “testpw3” ) is still on “can read”

And now to the bigger problem:
When we remove “testuser1” from the top folder “testdir1” the inheritance should remove the “testuser1” from all sub folder “testdir2” and “testdir3” and the passwords ( “testpw1”, “testpw2” and “testpw3” ).
Right now the folder “testdir1” is removed from the list for “testuser1” but the user can still access all passwords ( “testpw1”, “testpw2” and “testpw3” ) and the two directories ( “testdir2” and “testdir3” ) from the folder structure.
Example usage: A user switches departments in the organization

Environment: passbolt:2.14.0-pro-debian
Folder structure:
├── testdir2
│ ├── testdir3
│ │ └── testpw3
│ └── testpw2
└── testpw1

Best regards


[x] I have read intro post: About the Installation Issues category
[x] I have read the tutorials, help and searched for similar issues
[x] I provide relevant information about my server (component names and versions, etc.)
[x] I provide a copy of my logs and healthcheck
[x] I describe the steps I have taken to trouble shoot the problem
[x] I describe the steps on how to reproduce the issue

Health check
     ____                  __          ____
    / __ \____  _____ ____/ /_  ____  / / /_
   / /_/ / __ `/ ___/ ___/ __ \/ __ \/ / __/
  / ____/ /_/ (__  |__  ) /_/ / /_/ / / /
 /_/    \__,_/____/____/_.___/\____/_/\__/

 Open source password manager for teams
 Healthcheck shell


 [PASS] PHP version 7.3.24.
 [PASS] PCRE compiled with unicode support.
 [PASS] The temporary directory and its content are writable.
 [PASS] The public image directory and its content are writable.
 [PASS] The logs directory and its content are writable.
 [PASS] GD or Imagick extension is installed.
 [PASS] Intl extension is installed.
 [PASS] Mbstring extension is installed.

 Config files

 [PASS] The application config file is present
 [WARN] The passbolt config file is missing in /var/www/passbolt/config/
  [HELP] Copy /var/www/passbolt/config/passbolt.default.php to /var/www/passbolt/config/passbolt.php
  [HELP] The passbolt config file is not required if passbolt is configured with environment variables

 Core config

 [PASS] Debug mode is off.
 [PASS] Cache is working.
 [PASS] Unique value set for security.salt
 [PASS] Full base url is set to https://passbolt.example.com
 [PASS] App.fullBaseUrl validation OK.
 [PASS] /healthcheck/status is reachable.

 SSL Certificate

 [PASS] SSL peer certificate validates
 [PASS] Hostname is matching in SSL certificate.
 [PASS] Not using a self-signed certificate


 [PASS] The application is able to connect to the database
 [PASS] 35 tables found
 [PASS] Some default content is present
 [PASS] The database schema up to date.

 GPG Configuration

 [PASS] PHP GPG Module is installed and loaded.
 [PASS] The environment variable GNUPGHOME is set to /home/www-data/.gnupg.
 [PASS] The directory /home/www-data/.gnupg containing the keyring is writable by the webserver user.
 [PASS] The server gpg key is not the default one
 [PASS] The public key file is defined in config/passbolt.php and readable.
 [PASS] The private key file is defined in config/passbolt.php and readable.
 [PASS] The server key fingerprint matches the one defined in config/passbolt.php.
 [PASS] The server public key defined in the config/passbolt.php (or environment variables) is in the keyring.
 [PASS] There is a valid email id defined for the server key.
 [PASS] The public key can be used to encrypt a message.
 [PASS] The private key can be used to sign a message.
 [PASS] The public and private keys can be used to encrypt and sign a message.
 [PASS] The private key can be used to decrypt a message.
 [PASS] The private key can be used to decrypt and verify a message.
 [PASS] The public key can be used to verify a signature.

 Application configuration

 [FAIL] Could not connect to passbolt repository to check versions. It is not possible check if your version is up to date.
  [HELP] Check the network configuration to allow this script to check for updates.
 [PASS] Passbolt is configured to force SSL use.
 [PASS] App.fullBaseUrl is set to HTTPS.
 [PASS] Selenium API endpoints are disabled.
 [PASS] Search engine robots are told not to index content.
 [PASS] Registration is closed, only administrators can add users.
 [PASS] Serving the compiled version of the javascript app
 [PASS] All email notifications will be sent.

  1 error(s) found. Hang in there!

Thanks @abrix We are going to follow up with you on the Pro support channel.

We’re working on a fix that should be released this week. Thanks for the report @abrix.

1 Like

v2.13.8 source have been published on github and release have been approved on the Firefox add-on website. We’re still waiting approval from Chrome web store, could take a few hours, up to a few days.