Copy is blocked to the target folder due to invalid privilege escalation: Unsuccessful HTTP status code received
As of yesterday, user is unable to select a document to attach to a Box Sign Request, where the file attaching functionality worked a day prior. User is an Editor in the file/folder selected. We have not changed permissions for anyone in the organization for over a week.
Additionally user is unable to move files from one folder to another under the following circumstances, likely for the same reasons as above:
Folder 1: user permissions assigned via Group, granted Editor privileges
File within Folder 1 is requested to be copied/moved to Folder 2: user owns folder, so they have Owner privileges
Error dialog pops up:
You cannot move this item to the target destination because it leads to escalation of your privilege.
Best answer by SWSF
Never got a support reply, but we found the solution. The issue is that a user owns their assigned Box Sign folder, but does not own the folder where the original file resides. A workaround for this is to use Box Drive (desktop app) to copy/move a file to a folder the user owns, then initiate the Box Sign using that copied/moved file.
Alternatively, there is a setting you can toggle to bypass everything. Log in to your company’s admin account. Enterprise settings > Content & Sharing > Collaborating on Content > Move and Copy content to a folder. The option defaults to prevent a user from moving a file to a folder they own. If you select the second radio option and Save, that should stop the issue from occurring.
Disclaimer: I am not your CSO, I cannot speak for your own company’s policies regarding document management. Decide for internally before attempting either solution as both options allow a user to update a file’s ownership, and access, without approval. As such, it may be considered a security risk.
Sorry that I cannot help with the issue, but can confirm that I am having the exact same problem. One other twist, I am the admin for our Box account and hitting the same issue.
Never got a support reply, but we found the solution. The issue is that a user owns their assigned Box Sign folder, but does not own the folder where the original file resides. A workaround for this is to use Box Drive (desktop app) to copy/move a file to a folder the user owns, then initiate the Box Sign using that copied/moved file.
Alternatively, there is a setting you can toggle to bypass everything. Log in to your company’s admin account. Enterprise settings > Content & Sharing > Collaborating on Content > Move and Copy content to a folder. The option defaults to prevent a user from moving a file to a folder they own. If you select the second radio option and Save, that should stop the issue from occurring.
Disclaimer: I am not your CSO, I cannot speak for your own company’s policies regarding document management. Decide for internally before attempting either solution as both options allow a user to update a file’s ownership, and access, without approval. As such, it may be considered a security risk.
