.Pirátská strana » Technické oddělení » Údržba a provoz

Jan Hora:

už zase mi nejde mazat vlastní soubory (ani přesouvat a kopírování taky blbne)
konkrétně zde: https://mrak.pirati.cz/apps/files/?dir=/MS%20Praha%204/Kampa%C5%88%202022&fileid=3151099

Bylo provedene vysetrovani, a zjistene, ze v pripade existenci sdileni s nejakym konkretnim uzivatelem a jeho absenci v tabulce oc_user_oidc nastavaji ruzne chybove situace, predevsim nemoznost nastavovat ACL u group folder s takovym uzivatelem. pravdepodobne jsou i dalsi problemy. Takove uzivatele take nejsou videt ve sprave uzivatelu. Prozatim v tabulce bylo 320 uzivatelu (mj, to je cislo aktivnich uzivatelu nextcloud po prechodu ze SAML na OIDC). Resenim byl primy zasah do tatabaze - prevod vsech drive existujicich SAML uzivatelu na OIDC:

insert into oc_user_oidc (user_id,display_name) 
   select uid,displayname from oc_user_saml_users where uid not in (select user_id from oc_user_oidc);

#!/bin/bash

GF=/srv/nextcloud/__groupfolders
OCC='docker-compose -f /etc/docker/compose/nextcloud/docker-compose.yaml exec -u 33 app ./occ --no-ansi'

cd $GF 

for d in [0-9]*
do
   [ ! -d $d ] && continue

   $OCC groupfolders:permissions $d \
    | tail -n +2 \
    | head -n -1 \
    | sed 's/+-/|-/g' \
    | sed 's/-+/-|/g' \
    > "$d/ACL.md" 

   $OCC groupfolders:scan $d 
done

Jeden chytrak z jejich kraje nasdilel celou tuto slozku s PKS vysociny, a pak dochazelo ke kolizi primeho pristupu a toho sdileni.

Na zadost MO dohledana složka "Průzkumová pracovní skupina", odebrana D.Leštinovi, přesunuta pod RV, zpřistupněna MO a CVŠ

Po upgradu zmizela moznost konfigurovat ACL. Bug je popsany - https://github.com/nextcloud/groupfolders/issues/2637
Uz je mergeovany path v mainstreamu - https://github.com/nextcloud/groupfolders/pull/2660/files nicmene, jeste to neni zbuildovano. Brzy snad bude v upgradech plugnu

• snizena doba uschovy zaznamu v oc_activity z 90 na 14 dni
• vypnuta aplikace "File access control" - evidentne nefungovala, jen spamovala log
• vypnuta aplikace "Files automated tagging" - stejny problem
• vypnuta aplikace "README.md" - generovala chyby v logu

Aktualne nejcastejsi hlasky v logu (data za 900s):

   3831 "Flow activation: rules were requested for operation Automated tagging"
   3830 "No flow configurations is going to run Automated tagging"
   2134 "Creation of dynamic property OCA\\TextTemplates\\AppInfo\\Application::$container is deprecated at /var/www/html/custom_apps/text_templates/lib/AppInfo/Application.php#30"
   2134 "Creation of dynamic property OCA\\TextTemplates\\AppInfo\\Application::$config is deprecated at /var/www/html/custom_apps/text_templates/lib/AppInfo/Application.php#31"
    549 "could not get login credentials because the token is invalid: Token does not exist: token does not exist"
    424 "Impossible to decode OIDC token:Error: kid must be provided in JWT header."
    424 "Could not find unique token validation"
    188 "No calendar events found for status check"
    163 "could not get login credentials because the token has no password"
    118 "OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface"
     91 "Creation of dynamic property OCA\\Transfer\\Activity\\Providers\\TransferSucceededProvider::$activityManager is deprecated at /var/www/html/custom_apps/transfer/lib/Activity/Providers/BaseProvider.php#19"
     91 "Creation of dynamic property OCA\\Transfer\\Activity\\Providers\\TransferStartedProvider::$activityManager is deprecated at /var/www/html/custom_apps/transfer/lib/Activity/Providers/BaseProvider.php#19"
     91 "Creation of dynamic property OCA\\Transfer\\Activity\\Providers\\TransferFailedProvider::$activityManager is deprecated at /var/www/html/custom_apps/transfer/lib/Activity/Providers/BaseProvider.php#19"
     22 "Exception thrown: Sabre\\DAV\\Exception\\NotAuthenticated"

Vypada, ze ACL groupfolder se nechova uplne korektne - ve webovem rozhrani skupne uzivatele je povolen pristupke slozce, ve skutecnosti je nevidi. K oprave staci ten pristup odebrat a zase priradit. Duvod je neznamy

Testovalo se vytvoreni nove slozky ve skupinove slozce. Nepodarilo se prokazat zavislost na poctu uzivatelu ktere maji pristup ke slozce. Docela dlouho (stovky milivterin) se vykonavaji dotazy

 SELECT "storage_id", "root_id", "user_id", "mount_point", "mount_id", "f"."path", "mount_provider_class" FROM "oc_mounts" "m" INNER JOIN "oc_filecache" "f" ON "m"."root_id" = "f"."fileid" WHERE "storage_id" = 392

(storage 392 je groupfolders)

Z celkem 624265 zaznamu v databazi je ve storage392 504505. z cehoz 273201 - nahledy. tak je to trochu pomalejsi