From 9b7c14763df7bb8f25ff3fb88ccebf6d25dca981 Mon Sep 17 00:00:00 2001 From: whoalin1 Date: Wed, 7 Oct 2026 03:41:38 +0300 Subject: [PATCH] docs(admin): Flow file name regex (basename + delimiters) Closes #11435 Assisted-by: Cursor:grok-4.7 Signed-off-by: whoalin1 --- access_control.rst | 138 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 138 insertions(+) create mode 100644 access_control.rst diff --git a/access_control.rst b/access_control.rst new file mode 100644 index 00000000000..d7e36e1a3df --- /dev/null +++ b/access_control.rst @@ -0,0 +1,138 @@ +==================== +Files access control +==================== + +Nextcloud's File Access Control app enables administrators to create and +manage a set of rule groups. Each of the rule groups consists of one or more +rules. If all rules of a group hold true, the group matches the request and +access is being denied. The rules criteria range from IP address, to user +groups, collaborative tags and :ref:`some more `. + +.. note:: In case you are using the :ref:`Context Chat App `, + please keep in mind, that it is not affected by the File Access Control rules + and will respond with indexed information, even when the file is not accessible + by the user due to access control rules. + +Denied access +------------- + +If access to a file has been denied for a user, the user can not: + +* Create/upload the file +* Modify the files +* Delete the file +* Download the file +* Synchronize the file with clients, such as the Nextcloud desktop and mobile clients + +Examples +-------- +After installing the File Access Control app as described in :doc:`../apps_management` +navigate to the configuration and locate the settings for the Flow application. + + .. figure:: images/files_access_control_sample_rules.png + :alt: Sample rules to block on user group, time and IP base. + +The first rule group ``Support only 9-5`` denies any access to files for users +of the Support user group, between 5pm and 9am. + +The second rule group ``Internal testing`` prevents users of the Internal +testers group to access files from outside of the local network. + +Denying access to folders +------------------------- + +The easiest way to block access to a folder, is to use a collaborative tag. As +mentioned in the :ref:`Available rules ` section below, +either the file itself or one of the parents needs to have the given tag +assigned. + +So you just need to assign the tag to the folder or file, and then block the +tag with a rule group. The check is independent of the user's permissions for +the tag. Therefore restricted and invisible tags are recommended, otherwise a +user could remove and reassign the tag. + +This example blocks access to any folder with the tag ``Confidential``. + + .. figure:: images/files_access_control_collaborative_tags.png + :alt: Deny access based on collaborative tag + +Prevent uploading of specific files +----------------------------------- + +It's possible to prevent specific files from being uploaded to Nextcloud. You +simply need to define a rule based on the mimetype and our powerful access control +engine will block any attempt to upload the file. The safest way to define the rule +is to use a regular expression, as it will help you cover all the known media types +used for the type of file you're trying to block. + +The following example prevents zip files from being uploaded by using the regular +expression: ``/^application\/(zip|x-zip-compressed)$/i`` + + .. figure:: images/files_access_control_block_mimetype.png + :alt: Prevent upload based on mimetype + +Common misconfigurations +------------------------ + +Blocking user groups +^^^^^^^^^^^^^^^^^^^^ + +When trying to deny access to a group of users, make sure that sharing does not +allow them to create a way back in. When users are able to create a public link, +the users can log themselves out and visit their own public link to access the +files. Since at this point they are no user and therefore no member of the +blocked group, they will be able to read and change the file. + +The recommended work around is to create the same rule again, and deny access +for all users that are ``not member of`` a group, that contains all users of +your installation. + +External storage +^^^^^^^^^^^^^^^^ + +While access to files in external storages is not possible via Nextcloud, users +that have direct access to the external storage, can of course change files +there directly. Therefore it is recommended to disable the ``Allow users to mount +external storage`` option, when trying to to completely lock out users. + +.. _available-rules-label: + +Available rules +--------------- + +All rules can also be inverted (from ``is`` to ``is not``) using the operator +option. + +* **File collaborative tag:** Either the file itself, or any of the file + owner's parent folders needs to be tagged with the tag. + + .. note:: Tags used in access control rules should be restricted tags, + otherwise any user can remove the tag to access the file again. + The best way to do this is with the :doc:`automated_tagging`. + +* **File MIME type:** The MIME type of the file, e.g. ``text/plain`` for a text file or ``httpd/unix-directory`` for a folder. + + .. note:: see `mimetypealiases.dist.json `_ for a full list of possible MIME types. + +* **File name:** The **base name** of the file only (not the folder path). + ``is`` / ``is not`` compare case-insensitively against that base name. + + For pattern matching, choose the ``matches`` / ``does not match`` operators + and enter a **PHP regular expression including delimiters**, for example + ``/^dummy-.+$/i``. The expression is applied with ``preg_match`` to the file + base name, so patterns that include directory separators (for example + ``/my/folder/.+``) will not match. Escape delimiter characters inside the + pattern (or pick a delimiter that does not appear in it). Invalid regular + expressions are rejected when saving the flow. + +* **File size:** The size of the file (*Only available on upload*) + +* **Request remote address:** An IP range (either v4 or v6) for the accessing user +* **Request time:** Time span and timezone when the request happens +* **Request URL:** The URL which requests the file. (*This is the URL the file + is served from, not the URL the user is currently looking at.*) +* **Request user agent:** The user agent of the users browser or client. + Nextcloud desktop, Android and iOS clients are available as preconfigured + options. + +* **User group membership:** Whether the user is a member of the given group.