nextcloud · camilasan · May 7, 2026 · May 7, 2026
@@ -1,3 +1,3 @@
 /*
 * SPDX-FileCopyrightText: 2021 Nextcloud GmbH and Nextcloud contributors
 * SPDX-FileCopyrightText: 2018 ownCloud GmbH
@@ -28,10 +28,10 @@

 namespace
 {
 constexpr const char *editorNamesForDelayedUpload[] = {"PowerPDF"};
 constexpr const char *fileExtensionsToCheckIfOpenForSigning[] = {".pdf"};
 constexpr auto delayIntervalForSyncRetryForOpenedForSigningFilesSeconds = 60;
 constexpr auto delayIntervalForSyncRetryForFilesExceedQuotaSeconds = 60;
 }

 namespace OCC {
@@ -61,7 +61,7 @@
    computePinState(parent->_pinState);
 }

 ProcessDirectoryJob::ProcessDirectoryJob(DiscoveryPhase *data, PinState basePinState, const PathTuple &path, const SyncFileItemPtr &dirItem, const SyncFileItemPtr &parentDirItem, QueryMode queryLocal, qint64 lastSyncTimestamp, QObject *parent)
        : QObject(parent)
        , _dirItem(dirItem)
        , _dirParentItem(parentDirItem)
@@ -232,7 +232,7 @@

        const auto willBeExcluded = handleExcluded(path._target, e, entries, isHidden, isBlacklisted);

        if (willBeExcluded) {
            continue;
        }

@@ -277,11 +277,11 @@
                                            || excluded == CSYNC_FILE_EXCLUDE_TRAILING_SPACE
                                            || excluded == CSYNC_FILE_EXCLUDE_LEADING_AND_TRAILING_SPACE;

    const auto leadingAndTrailingSpacesFilesAllowed = !_discoveryData->_shouldEnforceWindowsFileNameCompatibility || _discoveryData->_leadingAndTrailingSpacesFilesAllowed.contains(_discoveryData->_localDir + path);
 #if defined Q_OS_WINDOWS
    if (hasLeadingOrTrailingSpaces && leadingAndTrailingSpacesFilesAllowed) {
 #else
    if (hasLeadingOrTrailingSpaces && (wasSyncedAlready || leadingAndTrailingSpacesFilesAllowed)) {
 #endif
        excluded = CSYNC_NOT_EXCLUDED;
    }
@@ -404,7 +404,7 @@
            } else {
                char invalid = '\0';
                constexpr QByteArrayView invalidChars("\\:?*\"<>|");
                for (const auto x : invalidChars) {
                    if (item->_file.contains(x)) {
                        invalid = x;
                        break;
@@ -426,21 +426,21 @@
            }
            item->_status = SyncFileItem::FileNameInvalid;
            break;
        case CSYNC_FILE_EXCLUDE_TRAILING_SPACE:
            item->_errorString = tr("Filename contains trailing spaces.");
            item->_status = SyncFileItem::FileNameInvalid;
            if (isLocal && !maybeRenameForWindowsCompatibility(_discoveryData->_localDir + item->_file, excluded)) {
                item->_errorString += QStringLiteral(" %1").arg(tr("Cannot be renamed or uploaded."));
            }
            break;
        case CSYNC_FILE_EXCLUDE_LEADING_SPACE:
            item->_errorString = tr("Filename contains leading spaces.");
            item->_status = SyncFileItem::FileNameInvalid;
            if (isLocal && !maybeRenameForWindowsCompatibility(_discoveryData->_localDir + item->_file, excluded)) {
                item->_errorString += QStringLiteral(" %1").arg(tr("Cannot be renamed or uploaded."));
            }
            break;
        case CSYNC_FILE_EXCLUDE_LEADING_AND_TRAILING_SPACE:
            item->_errorString = tr("Filename contains leading and trailing spaces.");
            item->_status = SyncFileItem::FileNameInvalid;
            if (isLocal && !maybeRenameForWindowsCompatibility(_discoveryData->_localDir + item->_file, excluded)) {
@@ -468,7 +468,7 @@
        case CSYNC_FILE_EXCLUDE_CANNOT_ENCODE:
            item->_errorString = tr("The filename cannot be encoded on your file system.");
            break;
        case CSYNC_FILE_EXCLUDE_SERVER_BLACKLISTED:
            const auto errorString = tr("The filename is blacklisted on the server.");
            QString reasonString;
            if (hasForbiddenFilename) {
@@ -513,7 +513,7 @@
    const auto conflictRecord = _discoveryData->_statedb->caseConflictRecordByPath(path.toUtf8());
    const auto originalBaseFileName = QFileInfo(QString(_discoveryData->_localDir + "/" + conflictRecord.initialBasePath)).fileName();

    if (allEntries.find(originalBaseFileName) == allEntries.end()) {
        // original entry is no longer on the server, remove conflicted copy
        qCDebug(lcDisco) << "original entry:" << originalBaseFileName << "is no longer on the server, remove conflicted copy:" << path;
        return true;
@@ -694,7 +694,7 @@
        _pendingAsyncJobs++;
        _discoveryData->checkSelectiveSyncNewFolder(path._server,
                                                    serverEntry.remotePerm,
                                                    [=, this](bool result) {
                                                        --_pendingAsyncJobs;
                                                        if (!result) {
                                                            processFileAnalyzeLocalInfo(item, path, localEntry, serverEntry, dbEntry, _queryServer);
@@ -754,7 +754,7 @@
    if (item->_e2eEncryptionStatusRemote != SyncFileItem::EncryptionStatus::NotEncrypted) {
        Q_ASSERT(item->_e2eEncryptionStatus != SyncFileItem::EncryptionStatus::NotEncrypted);
    }
    item->_encryptedFileName = [=, this] {
        if (serverEntry.e2eMangledName.isEmpty()) {
            return QString();
        }
@@ -1061,7 +1061,7 @@
            // we need to make a request to the server to know that the original file is deleted on the server
            _pendingAsyncJobs++;
            const auto job = new RequestEtagJob(_discoveryData->_account, _discoveryData->_remoteFolder + originalPath, this);
            connect(job, &RequestEtagJob::finishedWithResult, this, [=, this](const HttpResult<QByteArray> &etag) mutable {
                _pendingAsyncJobs--;
                QTimer::singleShot(0, _discoveryData, &DiscoveryPhase::scheduleMoreJobs);
                if (etag || etag.error().code != 404 ||
@@ -1138,7 +1138,7 @@
    qCDebug(lcDisco) << "_dirItem->_folderQuota.bytesAvailable:" << _dirItem->_folderQuota.bytesAvailable;

    SyncJournalFileRecord dirItemDbRecord;
    if (_discoveryData->_statedb->getFileRecord(_dirItem->_file, &dirItemDbRecord) && dirItemDbRecord.isValid()) {
        const auto dirDbBytesAvailable = dirItemDbRecord._folderQuota.bytesAvailable;
        qCDebug(lcDisco) << "Returning for item quota db value dirItemDbRecord._folderQuota.bytesAvailable" << dirDbBytesAvailable;
        return dirDbBytesAvailable;
@@ -1190,7 +1190,7 @@

    _childModified |= serverModified;

    auto finalize = [&] {
        bool recurse = item->isDirectory() || localEntry.isDirectory || serverEntry.isDirectory;
        // Even if we have a local directory: If the remote is a file that's propagated as a
        // conflict we don't need to recurse into it. (local c1.owncloud, c1/ ; remote: c1)
@@ -1232,6 +1232,11 @@
             }
 
             item->_status = SyncFileItem::Status::NormalError;
+            // Mark as a quota error so blacklistUpdate writes an InsufficientRemoteStorage entry.
+            // Without this, _httpErrorCode would be 0 and blacklistUpdate would not create an
+            // entry, leaving the file unprotected by checkNewDeleteConflict if the remote parent
+            // folder is deleted before the quota situation is resolved.
+            item->_httpErrorCode = 507;
             _discoveryData->_anotherSyncNeeded = true;
             _discoveryData->_filesNeedingScheduledSync.insert(path._original, delayIntervalForSyncRetryForFilesExceedQuotaSeconds);
         }
@@ -1478,7 +1483,7 @@
    item->_checksumHeader.clear();
    item->_size = localEntry.size;
    item->_modtime = localEntry.modtime;
    item->_type = localEntry.isDirectory && !localEntry.isVirtualFile ? ItemTypeDirectory : localEntry.isDirectory ? ItemTypeVirtualDirectory : localEntry.isVirtualFile ? ItemTypeVirtualFile : ItemTypeFile;
    _childModified = true;

    if (!localEntry.caseClashConflictingName.isEmpty()) {
@@ -1594,7 +1599,7 @@
            item->_e2eEncryptionServerCapability = EncryptionStatusEnums::fromEndToEndEncryptionApiVersion(_discoveryData->_account->capabilities().clientSideEncryptionVersion());
            if (item->_e2eEncryptionStatus != item->_e2eEncryptionServerCapability) {
                item->_e2eEncryptionStatus = item->_e2eEncryptionServerCapability;
                if (base._e2eEncryptionStatus != SyncJournalFileRecord::EncryptionStatus::NotEncrypted) {
                    Q_ASSERT(item->_e2eEncryptionStatus != SyncFileItem::EncryptionStatus::NotEncrypted);
                }
            }
@@ -1610,7 +1615,7 @@
    const auto serverHasMountRootProperty = _discoveryData->_account->serverHasMountRootProperty();
    const auto isExternalStorage = base._remotePerm.hasPermission(RemotePermissions::IsMounted) && base.isDirectory();
    const auto movePerms = checkMovePermissions(base._remotePerm, originalPath, item->isDirectory());
    if (!movePerms.sourceOk || !movePerms.destinationOk || (serverHasMountRootProperty && isExternalStorage) || isE2eeMoveOnlineOnlyItemWithCfApi) {
        qCInfo(lcDisco) << "Move without permission to rename base file, "
                        << "source:" << movePerms.sourceOk
                        << ", target:" << movePerms.destinationOk
@@ -1634,7 +1639,7 @@

        // Here we know the new location can't be uploaded: must prevent the source delete.
        // Two cases: either the source item was already processed or not.
        auto wasDeletedOnClient = _discoveryData->findAndCancelDeletedJob(originalPath);
        if (wasDeletedOnClient.first) {
            // More complicated. The REMOVE is canceled. Restore will happen next sync.
            qCInfo(lcDisco) << "Undid remove instruction on source" << originalPath;
@@ -1651,7 +1656,7 @@
        return;
    }

    auto wasDeletedOnClient = _discoveryData->findAndCancelDeletedJob(originalPath);

    auto processRename = [item, originalPath, base, this](PathTuple &path) {
        auto adjustedOriginalPath = _discoveryData->adjustRenamedPath(originalPath, SyncFileItem::Down);
@@ -1695,7 +1700,7 @@
        if (base.isVirtualFile() && isVfsWithSuffix())
            chopVirtualFileSuffix(serverOriginalPath);
        auto job = new RequestEtagJob(_discoveryData->_account, serverOriginalPath, this);
        connect(job, &RequestEtagJob::finishedWithResult, this, [=, this](const HttpResult<QByteArray> &etag) mutable {


            if (!etag || (etag.get() != base._etag && !item->isDirectory()) || _discoveryData->isRenamed(originalPath)
@@ -1741,7 +1746,7 @@
    // If there's no content hash, use heuristics
    if (serverEntry.checksumHeader.isEmpty()) {
        // If the size or mtime is different, it's definitely a conflict.
        bool isConflict = (serverEntry.size != localEntry.size) || (serverEntry.modtime != localEntry.modtime) || (dbEntry.isValid() && dbEntry._modtime != localEntry.modtime && serverEntry.modtime == localEntry.modtime);

        // It could be a conflict even if size and mtime match!
        //
@@ -1897,7 +1902,7 @@
        item->_direction = _dirItem->_direction;
    }

    {
        const auto isImportantInstruction = item->_instruction != CSYNC_INSTRUCTION_NONE;
        if (isImportantInstruction) {
            qCInfo(lcDisco).noquote() << item->_discoveryResult;
@@ -2117,12 +2122,12 @@
        return matchingEditorsKeepingFileBusy;
    }

    const auto isMatchingFileExtension = std::find_if(std::cbegin(fileExtensionsToCheckIfOpenForSigning), std::cend(fileExtensionsToCheckIfOpenForSigning),
        [path](const auto &matchingExtension) {
            return path._local.endsWith(matchingExtension, Qt::CaseInsensitive);
        }) != std::cend(fileExtensionsToCheckIfOpenForSigning);

    if (!isMatchingFileExtension) {
        return matchingEditorsKeepingFileBusy;
    }

@@ -2130,8 +2135,8 @@
    const auto editorsKeepingFileBusy = Utility::queryProcessInfosKeepingFileOpen(fullLocalPath);

    for (const auto &detectedEditorName : editorsKeepingFileBusy) {
        const auto isMatchingEditorFound = std::find_if(std::cbegin(editorNamesForDelayedUpload), std::cend(editorNamesForDelayedUpload),
            [detectedEditorName](const auto &matchingEditorName) {
                return detectedEditorName.processName.startsWith(matchingEditorName, Qt::CaseInsensitive);
            }) != std::cend(editorNamesForDelayedUpload);
        if (isMatchingEditorFound) {
@@ -2270,7 +2275,7 @@
    }
 }

 DiscoverySingleDirectoryJob *ProcessDirectoryJob::startAsyncServerQuery()
 {
    if (_dirItem && _dirItem->isEncrypted() && _dirItem->_encryptedFileName.isEmpty()) {
        _discoveryData->_topLevelE2eeFolderPaths.insert(_discoveryData->_remoteFolder + _dirItem->_file);
@@ -2365,7 +2370,7 @@
 void ProcessDirectoryJob::startAsyncLocalQuery()
 {
    QString localPath = _discoveryData->_localDir + _currentFolder._local;
    auto localJob = new DiscoverySingleLocalDirectoryJob(_discoveryData->_account, localPath, _discoveryData->_syncOptions._vfs.data(), _discoveryData->_fileSystemReliablePermissions);

    _discoveryData->_currentlyActiveJobs++;
    _pendingAsyncJobs++;
@@ -2453,18 +2458,18 @@
    }
 }

 bool ProcessDirectoryJob::maybeRenameForWindowsCompatibility(const QString &absoluteFileName,
                                                             CSYNC_EXCLUDE_TYPE excludeReason)
 {
    auto result = true;

    const auto leadingAndTrailingSpacesFilesAllowed = !_discoveryData->_shouldEnforceWindowsFileNameCompatibility || _discoveryData->_leadingAndTrailingSpacesFilesAllowed.contains(absoluteFileName);
    if (leadingAndTrailingSpacesFilesAllowed) {
        return result;
    }

    const auto fileInfo = QFileInfo{absoluteFileName};
    switch (excludeReason)
    {
    case CSYNC_NOT_EXCLUDED:
    case CSYNC_FILE_LOCKED_SILENTLY_EXCLUDED:
@@ -2482,10 +2487,10 @@
        break;
    case CSYNC_FILE_EXCLUDE_LEADING_AND_TRAILING_SPACE:
    case CSYNC_FILE_EXCLUDE_LEADING_SPACE:
    case CSYNC_FILE_EXCLUDE_TRAILING_SPACE:
    {
        const auto removeTrailingSpaces = [] (QString string) -> QString {
            for (int n = string.size() - 1; n >= 0; -- n) {
                if (!string.at(n).isSpace()) {
                    string.truncate(n + 1);
                    break;
@@ -2505,18 +2510,42 @@
     return result;
 }
 
-bool ProcessDirectoryJob::checkNewDeleteConflict(const SyncFileItemPtr &item) const
+bool ProcessDirectoryJob::checkNewDeleteConflict(const SyncFileItemPtr &item)
 {
-    if (_discoveryData->recursiveCheckForDeletedParents(item->_file)) {
-        qCWarning(lcDisco) << "Removing local file inside a remotely deleted folder" << item->_file;
-        item->_instruction = CSYNC_INSTRUCTION_REMOVE;
-        item->_direction = SyncFileItem::Down;
-        item->_wantsSpecificActions = SyncFileItem::SynchronizationOptions::MoveToClientTrashBin;
+    if (!_discoveryData->recursiveCheckForDeletedParents(item->_file)) {
+        return false;
+    }
+
+    // If the file was blocked from uploading by a remote storage quota error it was never on the
+    // server, so deleting the local copy would be permanent data loss. Protect it instead and let
+    // the user resolve the situation (fix quota, then sync or move the file).
+    if (const auto blacklistEntry = _discoveryData->_statedb->errorBlacklistEntry(item->_file);
+        blacklistEntry.isValid()
+        && blacklistEntry._errorCategory == SyncJournalErrorBlacklistRecord::InsufficientRemoteStorage) {
+        qCWarning(lcDisco) << "Not removing local file inside a remotely deleted folder: "
+                              "file was never uploaded due to storage quota —"
+                           << item->_file;
+        item->_instruction = CSYNC_INSTRUCTION_ERROR;
+        item->_status = SyncFileItem::SoftError;
+        // Keep _httpErrorCode at 507 so blacklistUpdate re-creates (rather than wipes) the
+        // InsufficientRemoteStorage entry if the current ignore-duration later expires.
+        item->_httpErrorCode = 507;
+        item->_errorString = tr("\"%1\" was not deleted because its latest changes were not synced "
+                                "and your server quota was exceeded. "
+                                "Please manage your storage and try syncing again.")
+                                 .arg(item->_file);
+        // Prevent the parent directory from being deleted while a quota-blocked child exists.
+        _childIgnored = true;
         emit _discoveryData->itemDiscovered(item);
         return true;
     }
 
-    return false;
+    qCWarning(lcDisco) << "Removing local file inside a remotely deleted folder" << item->_file;
+    item->_instruction = CSYNC_INSTRUCTION_REMOVE;
+    item->_direction = SyncFileItem::Down;
+    item->_wantsSpecificActions = SyncFileItem::SynchronizationOptions::MoveToClientTrashBin;
+    emit _discoveryData->itemDiscovered(item);
+    return true;
 }
 
 }
@@ -6,7 +6,7 @@

 #pragma once

 #include <QObject>
 #include <cstdint>
 #include "csync_exclude.h"
 #include "discoveryphase.h"
@@ -39,7 +39,7 @@
 *
 * Results are fed outwards via the DiscoveryPhase::itemDiscovered() signal.
 */
 class ProcessDirectoryJob : public QObject
 {
    Q_OBJECT

@@ -249,10 +249,10 @@
     */
    void setupDbPinStateActions(SyncJournalFileRecord &record);

     bool maybeRenameForWindowsCompatibility(const QString &absoluteFileName,
                                             CSYNC_EXCLUDE_TYPE excludeReason);
 
-    [[nodiscard]] bool checkNewDeleteConflict(const SyncFileItemPtr &item) const;
+    [[nodiscard]] bool checkNewDeleteConflict(const SyncFileItemPtr &item);
 
     qint64 _lastSyncTimestamp = 0;
 

@@ -1,3 +1,3 @@
 /*
 * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
 * SPDX-FileCopyrightText: 2018 ownCloud, Inc.
@@ -8,7 +8,7 @@
 * any purpose.
 */

 #include <QtTest>
 #include "syncenginetestutils.h"
 #include <syncengine.h>

@@ -52,6 +52,80 @@
         QCOMPARE(fakeFolder.currentLocalState(), fakeFolder.currentRemoteState());
     }
 
+    // Verify that a file blocked from uploading by a remote storage quota error is
+    // protected from local deletion when the remote parent folder is subsequently deleted.
+    void testQuotaBlockedFileProtectedFromParentFolderDeletion()
+    {
+        FakeFolder fakeFolder{FileInfo::A12_B12_C12_S12()};
+
+        // Establish an initial clean sync: a1 and a2 exist on both sides.
+        QVERIFY(fakeFolder.syncOnce());
+        QCOMPARE(fakeFolder.currentLocalState(), fakeFolder.currentRemoteState());
+
+        // Add a new local file that will fail to upload due to remote quota (HTTP 507).
+        fakeFolder.localModifier().insert(QStringLiteral("A/quota_blocked.txt"), 100);
+        fakeFolder.serverErrorPaths().append(QStringLiteral("A/quota_blocked.txt"), 507);
+
+        // Sync: upload fails → file is blacklisted as InsufficientRemoteStorage.
+        QVERIFY(!fakeFolder.syncOnce());
+        {
+            auto entry = fakeFolder.syncJournal().errorBlacklistEntry(QStringLiteral("A/quota_blocked.txt"));
+            QVERIFY(entry.isValid());
+            QCOMPARE(entry._errorCategory, SyncJournalErrorBlacklistRecord::InsufficientRemoteStorage);
+        }
+
+        // The file was never uploaded.
+        QVERIFY(!fakeFolder.currentRemoteState().find(QStringLiteral("A/quota_blocked.txt")));
+
+        // Remove the server error so further requests to that path don't return 507.
+        fakeFolder.serverErrorPaths().clear();
+
+        // Server-side: folder A is moved/deleted (e.g., via the web interface).
+        fakeFolder.remoteModifier().remove(QStringLiteral("A"));
+
+        ItemCompletedSpy completeSpy(fakeFolder);
+        fakeFolder.syncOnce();
+
+        // *** Core assertion: quota-blocked file must NOT have been deleted locally. ***
+        QVERIFY(fakeFolder.currentLocalState().find(QStringLiteral("A/quota_blocked.txt")));
+
+        // Parent folder A must also survive because it still contains the protected file.
+        QVERIFY(fakeFolder.currentLocalState().find(QStringLiteral("A")));
+
+        // Previously-synced siblings must have been deleted locally (trust the server).
+        QVERIFY(!fakeFolder.currentLocalState().find(QStringLiteral("A/a1")));
+        QVERIFY(!fakeFolder.currentLocalState().find(QStringLiteral("A/a2")));
+
+        // The quota-blocked file must still not exist on the server.
+        QVERIFY(!fakeFolder.currentRemoteState().find(QStringLiteral("A/quota_blocked.txt")));
+
+        // The protected file must be reported as an error (or blacklisted-error) item, not silently ignored.
+        {
+            auto item = completeSpy.findItem(QStringLiteral("A/quota_blocked.txt"));
+            QVERIFY(item);
+            const bool isErrorItem = item->_instruction == CSYNC_INSTRUCTION_ERROR
+                || item->_instruction == CSYNC_INSTRUCTION_IGNORE; // BlacklistedError reuses IGNORE
+            QVERIFY(isErrorItem);
+            const bool isErrorStatus = item->_status == SyncFileItem::SoftError
+                || item->_status == SyncFileItem::BlacklistedError;
+            QVERIFY(isErrorStatus);
+        }
+    }
+
+    // Regression: non-quota new files in a server-deleted folder must still be deleted locally
+    void testDeleteDirectoryWithNewFileNoQuotaError()
+    {
+        FakeFolder fakeFolder{FileInfo::A12_B12_C12_S12()};
+        fakeFolder.remoteModifier().remove(QStringLiteral("A"));
+        fakeFolder.localModifier().insert(QStringLiteral("A/newfile.txt"), 100);
+
+        QVERIFY(fakeFolder.syncOnce());
+
+        // New local file with no quota blacklist entry must be removed when parent is deleted on server.
+        QVERIFY(!fakeFolder.currentLocalState().find(QStringLiteral("A/newfile.txt")));
+        QCOMPARE(fakeFolder.currentLocalState(), fakeFolder.currentRemoteState());
+    }
+
     void issue1329()
     {
         FakeFolder fakeFolder{ FileInfo::A12_B12_C12_S12() };