Re: Linux users can delete folders (including content) that are not shared with them

asnell

Dropbox Business Standard with multiple users. Folders that are not shared with a user still show as an empty folder for that user. They can access the folder but not the files - it looks like an empty folder. Linux (Ubuntu 22.04) users can simply delete that empty folder, which results in Dropbox removing it and its contents from all other users. That seems like a serious issue. Windows users get a message and Dropbox refuses to delete, but that's not the case in Ubuntu, it has to be recovered from Deleted Files - again.

Здравко

@asnell, when you login to dropbox.com with admin credentials and go to admin console, under settings there, what can be seen as content management? Is it set to "Everyone" or "Only admins"?

Make sure it's set to "Only admins"! Does this change something (to some extent at least)? 🧐

Add: After that, list the content in your Dropbox folder using:

ls -al

To be seen the dot folder' flags.

asnell

Hello @Здравко . That is better in some ways and I'll actually leave it set to "Only admins". You can see the top level Dropbox directory is now readonly.

However, this means even I can't create a top-level folder, even though I am admin. I can't even create one in the browser interface, the option is disabled!

It's OK, I can set it to "Everyone", create top-level folders and then set it back to "Only admins". It will be rare that I need to do that.

When set as "Only admins" and a user adds write access to the directory they can still delete an unshared folder but it only deletes it locally and it reappears at the next sync. So set at "Only admins" is much safer, if a little inconvenient.

Still not nice that an empty directory is shown but I can live with that.

Thank you for your help.

asnell

@Здравко - I see, I can create folders in the Admin section.

Thanks again.

Здравко

@asnell wrote:
...
However, this means even I can't create a top-level folder, even though I am admin. I can't even create one in the browser interface, the option is disabled!
...

Not exactly... When you logged in your application you become there just a team member (part of "Everyone" set), no more admin. That's why you cannot create such folder there - like "Everybody". 😉 As you found out, admin section does this.

Good luck.