Anyone can accept a share, not just the invited user

Bug #759582 reported by Ursula Junque
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu One Servers
New
Undecided
Unassigned

Bug Description

I received a share invitation for a folder in ubuntu one, in my registered email (of course :)), and just followed the link. After accepting the share, that was specifically saying that was shared with me, I realized the logged user wasn't me.

I'd expect to have a small check if the current logged user is not the invited user, so it would fail with a forbidden (like Google) or at least ask me if I'm sure of what I'm doing.

Also, the accept share page says that the file was shared with the invited user (me), asking me to check if that was correct and displaying me the option to accept it, making me believe I was logged in as such. I mean, I'm not used to check if I'm the logged user every time I decide to do something online. I know it's not usual to have more than one person using SSO in the same machine, but, well, that happened. :)

After a conversation with beuno, he explained that this decision of treating shares as consumable tokens was a design one. But I guess we all agree that's not good, so I'm filing this bug. :)

Ursula Junque (ursinha)
description: updated
description: updated
John Lenton (chipaca)
affects: ubuntuone-client → ubuntuone-servers
Changed in ubuntuone-servers:
assignee: nobody → Ubuntu One web team (ubuntuone-web)
Revision history for this message
John O'Brien (jdobrien) wrote :

This is actually is by design since at the time a share is created this way (to an email) there is no way to know who the user (sharee) is.

Curtis Hovey (sinzui)
Changed in ubuntuone-servers:
assignee: Registry Administrators (registry) → nobody
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.