View Issue Details

IDProjectCategoryView StatusLast Update
0016815ScribusOS-Win32public2022-09-27 18:47
Reporterf.vanhee Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status newResolutionopen 
PlatformWindowsOSWindows server 2016OS Version1607 -14393.2608
Product Version1.4.8 
Summary0016815: Scribus overrules GPO settings prohibiting access to local C:\ drive
DescriptionScribus is installed on RDS environment in a farm with 5 Windows server 2016 servers. Due to privacy restrictions, users should not be allowed to store or open files under c:\ drive.
GPO is configured to limit access to C:\drive

User Configuration>Policies>Administrative Templates> Windows Components/File Explorer

Settings:
Hide these specified drives In My Computer: Restrict A,B,C and D drives only
Prevent Access to drives from My computer: Restrict A,B,C and D drives only

However with this settings it is still possible in scribus to open the C:\ drive and see the content of the C:\Users folder. Due to privacy restrictions this should not be possible.
Steps To ReproduceLog on with test user:
Opening application Adobe Acrobat Reader DC
File>Open: C:\ drive is not shown; access to C:\ drive is prohibited (as set via GPO)

Opening application GIMP:
File-Open: C:\ drive can be openen, only personal folder under c:\users is shown (not via GPO, but allowed)

Opening application scribus:
File-Open: selecting C:\users shows all users currently logged in; this is not allowed
TagsNo tags attached.
PatchNo

Activities

f.vanhee

2022-06-21 07:02

reporter  

2022-06-21 08_49_57-Window.jpg (100,347 bytes)   
2022-06-21 08_49_57-Window.jpg (100,347 bytes)   
2022-06-21 08_53_57-Window.jpg (61,808 bytes)   
2022-06-21 08_53_57-Window.jpg (61,808 bytes)   
2022-06-21 08_57_55-Window.jpg (43,501 bytes)   
2022-06-21 08_57_55-Window.jpg (43,501 bytes)   
2022-06-21 08_58_48-Window.jpg (30,561 bytes)   
2022-06-21 08_58_48-Window.jpg (30,561 bytes)   

f.vanhee

2022-08-24 07:54

reporter   ~0049751

On a test server we configured NTFS permissions on folder C:\Users for principal differently differently than the standard Microsoft rules (applied on all production servers).
We omitted the traverse folder/execute file and List folder/read data NTFS permissions for this principal, and this gives us the expected behaviour/result the customer actually wants.

However it seems not a good idea to tamper with standard NTFS rights as applied by Microsoft on a windows standard folder, can these NTFS permissions be applied in Scribus for the account used to show directory contents for the File Open option?

(screenshots attached)

PeterBenedek

2022-08-25 05:37

developer   ~0049752

Last edited: 2022-08-25 05:45

This not Scribus fault!

" GPO is configured to limit access to C:\drive"
This is not true! This setting only hides the drive, but not from users, but from explorer!

Group Policy restrictions apply to the explorer file manager (file open window is also part of this API)!
Scribus uses its own file management window, that's why hidden drives are visible in the file open window.

Proposal:
Don't hide the drives. You apply access restrictions to user groups (write, read, delete etc.) at the root drive level (C:, D: etc.).

f.vanhee

2022-08-30 13:45

reporter   ~0049754

As already set the GPO settings applied limit both the access and the visibility of standard windows folders under C:\
Normally this is applied to limit access to 32bit and 64 bit program folders directory.
However in remote desktop server setting every user logged on to the server has his personal (profile) folder under c:\users.
A user can not access the user folder of another user so NTFS rights are already set correctly (as shown by screenshot attached).
It is the visibility of other users folders that is the main concern here.
Applying Access Based Enumeration (ABE) is not possible here as it concerns local non-shared drives, so SMB rights can not be applied.
Standard windows explorer has the same issue, as show by screenshots attached on a test server where GPO settings are not applied (screenshot windows exporer and libreoffice draw).
The only way to prevent this is by applying the GPO settings described above
User Configuration>Policies>Administrative Templates> Windows Components/File Explorer
Settings:
Hide these specified drives In My Computer: Restrict A,B,C and D drives only
Prevent Access to drives from My computer: Restrict A,B,C and D drives only
This gives the error when using standard windows explorer or other applications as Libreoffice Writer (screenshots attached)
This is not the case for Scribus (also screenshot attached).
2022-08-30 11_53_22-Window.jpg (157,282 bytes)   
2022-08-30 11_53_22-Window.jpg (157,282 bytes)   
2022-08-30 15_31_54-Window.jpg (57,641 bytes)   
2022-08-30 15_31_54-Window.jpg (57,641 bytes)   
2022-08-30 15_33_06-Window.jpg (50,817 bytes)   
2022-08-30 15_33_06-Window.jpg (50,817 bytes)   
2022-08-30 15_39_15-Window.jpg (79,374 bytes)   
2022-08-30 15_39_15-Window.jpg (79,374 bytes)   
2022-08-30 15_39_48-Window.jpg (32,778 bytes)   
2022-08-30 15_39_48-Window.jpg (32,778 bytes)   
2022-08-30 15_43_03-Window.jpg (62,409 bytes)   
2022-08-30 15_43_03-Window.jpg (62,409 bytes)   

cbradney

2022-09-27 18:47

administrator   ~0049772

Scribus doesn't use native dialogs as pointed out. There's no ability within Qt to respect GPOs so we cannot follow this.

Issue History

Date Modified Username Field Change
2022-06-21 07:02 f.vanhee New Issue
2022-06-21 07:02 f.vanhee File Added: 2022-06-21 08_49_57-Window.jpg
2022-06-21 07:02 f.vanhee File Added: 2022-06-21 08_53_57-Window.jpg
2022-06-21 07:02 f.vanhee File Added: 2022-06-21 08_57_55-Window.jpg
2022-06-21 07:02 f.vanhee File Added: 2022-06-21 08_58_48-Window.jpg
2022-06-21 07:18 jghali Priority high => normal
2022-08-24 07:54 f.vanhee Note Added: 0049751
2022-08-24 07:54 f.vanhee File Added: 20220824_Scribus_C_users_Principal_Everyone_NTFS_productionserver.jpg
2022-08-24 07:54 f.vanhee File Added: 20220824_Scribus_C_users_Principal_Everyone_NTFS_testserver.jpg
2022-08-24 07:54 f.vanhee File Added: 20220824_Scribus_C_users_result_productionserver.jpg
2022-08-24 07:54 f.vanhee File Added: 20220824_Scribus_C_users_result_testserver.jpg
2022-08-25 05:37 PeterBenedek Note Added: 0049752
2022-08-25 05:45 PeterBenedek Note Edited: 0049752
2022-08-30 13:45 f.vanhee Note Added: 0049754
2022-08-30 13:45 f.vanhee File Added: 2022-08-30 11_53_22-Window.jpg
2022-08-30 13:45 f.vanhee File Added: 2022-08-30 15_31_54-Window.jpg
2022-08-30 13:45 f.vanhee File Added: 2022-08-30 15_33_06-Window.jpg
2022-08-30 13:45 f.vanhee File Added: 2022-08-30 15_39_15-Window.jpg
2022-08-30 13:45 f.vanhee File Added: 2022-08-30 15_39_48-Window.jpg
2022-08-30 13:45 f.vanhee File Added: 2022-08-30 15_43_03-Window.jpg
2022-09-27 18:47 cbradney Note Added: 0049772