0

In G Suite, a user that does not have access to certain folders or files, cannot view them from their Drive dashboard. However, it became apparent to us Friday that if a file is moved, its activity is shown in the activity feed, and then a user that normally could not view that file, can click and view that file.

The file in question was uploaded to a non-public folder, then deleted (moved to trash), and users that did not have access to the non-public folder and the trash, could then click on and view the file from the Activity feed.

I've done some research on the topic and can disable all User activity feed access, but we'd rather make it so that users that do not have access, cannot see them on the feed.

Has anyone experienced this and have a solution? Google doesn't offer much other than to turn off Activity dashboard feed. Not our preferred solution unless this is all that is possible.

migrated from superuser.com Jan 28 at 21:18

This question came from our site for computer enthusiasts and power users.

  • If the file isn't shared with the user or with anyone with the link then the can't access the file but if this is failing then report it immediately to G Suite support as this is major failure of the system. – Rubén Jan 29 at 0:48
  • 1
    Thanks for the suggestion, I reached out to G Suite support and were able to get a handle on this. Essentially, a file can have its own permissions, and if it's uploaded to a public folder at all, can still be viewed by anyone that originally could see it. Best bet is to not upload to a public folder in the first place, but then also verify the file itself isn't shared with everyone. – J A Pytlak Jan 29 at 13:54
0

A file is only generally accessible to the public if link sharing is on for that file. The link could allow either edit, comment or view-only access, but only one setting can be applied to the link at a time.

The file in question was accessible by others either because its link sharing was turned on, or those people were granted access from their accounts. From your comment, it is likely that a number of people were granted access to the file from their accounts due to the file taking on the same sharing settings of a folder it was put in to. The folder is shared with a number of people, and those people have the same permissions on files inside the folder by default (there is a warning message to this effect when files are moved into the folder). However, it is a good idea to review the sharing settings on files inside the folder, and change those settings on the file depending on how critical the file is. The same goes when you remove a file (as removing the file does not permanently delete it). Removing the file doesn't change the sharing settings on the file, and people can still access that file by looking in the My Activity pane on the right, as you mentioned.

To undo the share, it is best to move the file out of the shared folder, rather than remove it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.