Interoperability failure retrieving list of sharees

[dkocher]

Sharing a file or folder fails with Bad Request. search must not be empty. Please contact your web hosting service provider for assistance. when connected to oCIS.

HTTP/1.1 400 Bad Request
Content-Length: 156
Content-Type: text/xml; charset=utf-8
Date: Tue, 16 Apr 2024 08:16:52 GMT
Ocs-Api-Version: 2
Vary: Origin
X-Request-Id: bf1ed42bf42f/8qs05uaikb-001716

<?xml version="1.0" encoding="UTF-8"?>
<ocs><meta><status>error</status><statuscode>400</statuscode><message>search must not be empty</message></meta></ocs>

[dkocher]

According to ¹ the OCS API is deprecated and we should probably aim to support sharing via LibreGraph API.

Footnotes

1. https://owncloud.dev/ocis/adr/0022-sharing-and-space-management-api/#new-ocs-api-version ↩

[dkocher]

Originally implemented for #14197.

[dkocher]

Relates to #14166.

[micbar]

Can you please post the request to better understand the context?

[dkocher]

This is the HTTP transcript ✅ with demo.owncloud.com

GET /ocs/v1.php/apps/files_sharing/api/v1/sharees?lookup=true&shareType=0&itemType=file HTTP/1.1
OCS-APIRequest: true
Accept: application/xml
Host: demo.owncloud.com
Connection: Keep-Alive
User-Agent: Cyberduck/8.8.3.41360 (Mac OS X/14.4.1) (aarch64)
Accept-Encoding: gzip,deflate
Authorization: Basic ***

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Length: 173
Content-Security-Policy: default-src 'none';manifest-src 'self';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self';connect-src 'self';media-src 'self'
Content-Type: application/xml; charset=utf-8
Date: Fri, 19 Apr 2024 09:58:59 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
Set-Cookie: oc_sessionPassphrase=JdoUXqcN%2Bk67%2BQjgf8v%2FrebLvJajmLE8Y4biJd7P7Wn9ci0lb4%2BOvAj09cQcTXzGx4cnJBKcal1vzeIXR7vViP5tV17WN8%2B8X1IXgc12Mvx59B1BbO%2FQAP6Esv9gc4NJ; expires=Fri, 19-Apr-2024 10:18:59 GMT; Max-Age=1200; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=315360000; preload
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: none
X-Xss-Protection: 0

<?xml version="1.0"?>
<ocs>
 <meta>
  <status>ok</status>
  <statuscode>100</statuscode>
  <message>OK</message>
  <totalitems></totalitems>
  <itemsperpage></itemsperpage>
 </meta>
 <data>
  <exact>
   <users/>
   <groups/>
   <remotes/>
  </exact>
  <users/>
  <groups/>
  <remotes/>
 </data>
</ocs>

compared to the HTTP transcript 🔴 with ocis.ocis-keycloak.latest.owncloud.works

GET /ocs/v1.php/apps/files_sharing/api/v1/sharees?lookup=true&shareType=0&itemType=file HTTP/1.1
OCS-APIRequest: true
Accept: application/xml
Host: ocis.ocis-keycloak.latest.owncloud.works
Connection: Keep-Alive
User-Agent: Cyberduck/8.8.3.41360 (Mac OS X/14.4.1) (aarch64)
Accept-Encoding: gzip,deflate

HTTP/1.1 200 OK
Content-Length: 156
Content-Type: text/xml; charset=utf-8
Date: Fri, 19 Apr 2024 10:03:43 GMT
Ocs-Api-Version: 1
Vary: Origin
X-Request-Id: 99f613002519/1BVTOuqA6z-001079

<?xml version="1.0" encoding="UTF-8"?>
<ocs><meta><status>error</status><statuscode>400</statuscode><message>search must not be empty</message></meta></ocs>

(The previous 400 Bad Request was when requesting the v2.php /ocs/v2.php/apps/files_sharing/api/v1/sharees?lookup=true&shareType=0&itemType=file)

[micbar]

Thanks for the details.

This is security related. In infinite scale, we do not accept a sharee search request without a search term. We don't want to be able to list all possible users. That would disclose too much information.

Example Request

search=ein

curl 'https://ocis.ocis-wopi.released.owncloud.works/ocs/v2.php/apps/files_sharing/api/v1/sharees?search=ein&itemType=folder&page=1&perPage=200&format=json' \
  -H 'accept: */*' \
  -H 'accept-language: en' \
  -H 'authorization: Bearer <access-token>' \
  -H 'cache-control: no-cache' \
  -H 'ocs-apirequest: true' \

Response

{
  "ocs": {
    "meta": {
      "status": "ok",
      "statuscode": 200,
      "message": "OK"
    },
    "data": {
      "exact": {
        "users": [],
        "groups": [],
        "remotes": []
      },
      "users": [
        {
          "label": "Albert Einstein",
          "value": {
            "shareType": 0,
            "shareWith": "einstein",
            "shareWithProvider": "",
            "shareWithAdditionalInfo": "einstein@example.org",
            "userType": 0
          }
        }
      ],
      "groups": [],
      "remotes": []
    }
  }
}

[dkocher]

Thanks for the clarification @micbar.

[dkocher]

In bb859c1.