Bugzilla – Bug 931221
I18N - German translations for sharing right explanations are missing
Last modified: 2015-12-02 19:40:05 UTC
Created attachment 634550 [details] German translations for sharing right explanations are missing When sharing a folder or workspace the German translations for sharing right explanations are missing. See screenshot.
Reassigned to localization team.
What's the status of this bug? First: the description is only available in English. Second: the explanation is completely wrong! Users you're sharing with get much more rights than told in the explanation text.
All customer sites affected! That's not just an I18N issue due to the fact that also the information in English is completely wrong and users are e.g. able to delete folders etc. You just need to do some test cases and you'll notice.
Pulled CCB for review
The German customer base is very important for Vibe's success in the market. German customers always loved Vibe and it's stability and you should try to avoid unnecessary glitches like missing translations etc. Of course we can translate these explanations ourselves and add them to the I18N/L10N configs in the system but unfortunately not all Vibe customers in Germany are Code and Concept's customers. ;-) (This is just a reminder since the status of the bug still seems to be "NEW" and the fix would be so easy.)
Marked NeedInfo to Erik, Erik, The German localizations are in place now for Vibe 4.0.1. As you noted, these strings were never localized in Vibe 4.0. If you have the beta code, you can try them out. I'd like some more information from you as to exactly what wording you're concerned with as being wrong. In working with this, if the only rights being granted to a a user were because of the share, I'm not sure I see anything wrong. Some concrete examples would be useful.
Hi Dennis, the German localizations are in place now, correct! Thanks to the team for that. Unfortunately the description about which rights are granted to users being shared with are still wrong, both in German and in English - which means: in general. 1. A user getting shared a folder or workspace with contributor rights gets far more rights than stated in the documentation/explanation. Contributors are indeed able to modify, move or delete binders or workspaces! The info text says the opposite! This can lead to data loss. 2. additionally it should be pointed out that "viewers" are able to add comments. For Filr this behaviour has until now been accepted by users/admins, but in Vibe there has always been a quite powerful rights and roles concept that allowed workspace and folder admins to prevent users from adding comments by granting them only read rights. HTH Cheers Erik
Created attachment 655037 [details] Participant, Contribution, and Administrator Roles in Vibe Before I can modify this text, I need to know if I'm reading Erik's first point in Comment #9 correctly, and whether this is really working like it's supposed to work. In Filr, the Contributor role doesn't let a non-owner affect the folder that is shared, only its contents. From a security standpoint, that makes sense to me. If I share a folder with someone, I don't want them, under any circumstances, to be able to delete the folder. However, Erik's comment sounds like a non-owner is able to change/delete the parent folder/workspace in Vibe if assigned the Contributor Role as part of a share. I asked Craig Altom about this and he pointed me to the dialog and role summaries shown in the attached screen shot. From what I can see, neither the Participant nor Contribution roles include rights to delete the parent folder or workspace itself. However, the Workspace and Folder Administrator role can. Has the "Administrator" role been mapped to "Contributor" or are rights being pulled from some other source? Can a non-owner really delete a folder/workspace after simply receiving a share as a Contributor? Or have I misunderstood Erik's comment?
Made comment#11 public and added a NeedInfo to Erik. Erik, would you respond to comment#11? Thanks!
Hi Larry, hi everyone, I am with you, Larry! I also want the person being shared with only to be able to add and modify contents (files, entries) but not being able to delete the folder itself. But please please please just do some simple tests! It takes 3 minutes to reproduce it: In both - Vibe and Filr (!) - a non owner can indeed delete a folder (or even a workspace (Vibe) ) if this folder was shared with him granting him "Contributor" rights! This is what I am trying to explain for a few months now. The first time I saw this behavior and mentioned it (during I Filr beta as I remember) was in Filr 1-2 years ago! All of our sites show that behavior, be it Vibe or Filr. All customer sites are affected! I do not know why you're unable to reproduce it. Most of the systems we're taking care of have been updated from version to version over the last years, but not all of them. I do not know why you're unable to reproduce it. I really do not know. And it is not only a Vibe issue, it also behaves the same in Filr! Steps to reproduce (in Filr): 1. log in as an internal user 2. create a folder in your "my files" area 3. share that folder with an external user 4. log in as the external user 5. delete the folder (The same for Vibe.) We can do a remote session and I'll showcase it to you. No problem.
Given the way things stand, this is working as designed, for better or worse. We've gone round-and-round several times since the inception of sharing in Filr as to what rights are granted for which level of sharing. For Contributor, the rights currently granted include: WorkAreaOperation.READ_ENTRIES WorkAreaOperation.ADD_REPLIES WorkAreaOperation.MODIFY_ENTRIES WorkAreaOperation.RENAME_ENTRIES WorkAreaOperation.CREATE_ENTRIES WorkAreaOperation.CREATE_FOLDERS WorkAreaOperation.DELETE_ENTRIES WorkAreaOperation.BINDER_ADMINISTRATION WorkAreaOperation.ADD_COMMUNITY_TAGS WorkAreaOperation.GENERATE_REPORTS It's the WorkAreaOperation.BINDER_ADMINISTRATION rights here that are the issue as it's that right that allows the share recipient to do EVERYTHING and ANYTHING to the folder including delete and renaming it. This right being part of contributor access has a long history. It appears as though it was included with the original design, then removed as part of the fix for bug#845197 then added back in again to fix bug#865715 and bug#864190 (these were logged after bug#845197 was fixed, i.e., after the right was removed.) IMO, the problem here is one fundamental to the way sharing rights were designed. What's really needed is that when sharing a folder, we need to be granting different sets of rights to the recipient on the shared folder itself vs. on the contents of that shared folder. For contributor, the recipient needs different levels of rights to the folder vs. its contents. Right now, the rights to the contents are inherited from the shared folder. I don't see this changing in the short term and we should, at least for now, change the wording of what Contributor means to include the fact that the recipients have FULL binder administration rights to the folder including the ability to delete and rename it.
Added NeedInfo to Larry again for wording changes as per comment#14 and the earlier comments.
Replace the last sentence under Contributor (Cannot perform actions on the folder or workspace itself) with the following: Can also rename and delete the folder or workspace itself.
Marked Resolved/Fixed. The fix for this has been checked into the Filr Axion / Vibe 4.0.1 code base. ssf revision: 22997 - - - - - Notes: 1) The wording change made was as per comment#16. 2) Since this involved a string change, the change won't show up in other than English until a localization run is made that picks up and localizes the change.
This fix is in the Vibe OnPrem Filr 2.0.0 build 20151110081551. open source project revision 22998, and closed source project revision 7925.
Verified that in the Vibe_OnPrem/enterprise/4.0.1/20151117201507, then English version includes the additional text. Localization will update the other languages.