Hi Christoph,

Thank you for your report. By reading your description I don't understand how your user is created. Can you please give a step by step explanation. Currently TYPO3 overwrites to permission from user to group. This is the intended way.

Otherwise it would not possible to give specific access to just one user.

Some tests performed with TYPO3 9.2-dev (latest master)

Test 1¶

1) Set a be usergroup: with a filemount and
- give all permissions to directories
- give all permissions to files

2) create a be user, assign it to the group created at 1) , check "Mount from group: File Mounts"
- give ONLY "read" permission for files and directories

switch user to the user created at 2) and visit a folder (with some files) in the filemount

result: the user can do everything, so the usergroup permissions seem used¶

Test 2¶

1) Set a be usergroup: with a filemount and
- give all permissions to directories except delete folder
- give all permissions to files except delete files

2) create a be user, assign it to the group created at 1) , check "Mount from group: File Mounts"
- give ONLY "delete" permission to directories and files

result: the user can delete both files and directories¶

Considerations¶

The behavior observed makes me think that the permissions from groups and users are somehow "merged"; I guess that the explanation is: in group/user permissions the "unchecked" state does not mean "deny", but it means "not set". I think it is coherent with the result of the tests.

Is this the expected behavior?

p.s. I guess that a consequence of this behavior is that it is impossible to have a user with less privileges than its group. For example it is impossible that a group can delete files, while its user cannot do that