Possibly removed data after password dialogue?

Server
1

Hello community,

versions in use:

  • ownCloud desktop client (Windows, latest stable)
  • ownCloud from UCS AppCenter (v=10.3.2)

we had a rather curious case today. One of our users changed the user password on Friday, but only today the ownCloud client asked for the new password. Until the (new) password was requested, ownCloud worked like a charm.

Since the user entered the new password, the folder where the user was working in was removed.

We found the deleted folder inside the owncloud admin’s trash bin, and we were able to restore the folder and its contents.

I checked the log files but was unable to find a cause for the deletion.

Is there a way to log such behaviour in more detail, than what the app is currently logging (current loglevel in config.php is 2)?

Cheers,
Timo

2

Hello Timo,

you can increase the log level to debug but this would lead to a big log file and possible storage space issues.

We have an enterprise app called admin audit which increases the precision of the logging even more.

Can you tell me what kind of user this was? A local user or LDAP user or a guest user?

Best Regards

Dmitry

3

Hello Dmitry,

the user is an LDAP user, logged in to Windows 10, with a valid kerberos ticket.

What also happened after restoring the folder from the owncloud admin’s trash bin: all links previously generated for files in the ex-deleted folder changed. Is this the normal behaviour when restoring files from the trash bin?

Timo

4

I don’t think this is normal since the file landed in the admin trash bin instead of the user trash bin.

Has the fileID changed after the file was restored? If you have a link that worked before the restore you can check if it changed after the restore.

5

Yes, the links changed. I tried to access a file with the old link and got a 404. Accessing the file with the new link worksas expected.

From what I saw from the logfiles, no DELETE was logged in the time window where the folder was deleted, several MOVEs were logged, but all on other folders, not the deleted folder.

I will try the admin audit app.