fix: Exclude non accepted shares when computing access list

Signed-off-by: Louis Chemineau <louis@chmn.me>

Author: artonge

lib/private/Share20/DefaultShareProvider.php

@@ -1343,6 +1343,18 @@ public function getAccessList($nodes, $currentAccess) {
 				$qb->expr()->eq('item_type', $qb->createNamedParameter('file')),
 				$qb->expr()->eq('item_type', $qb->createNamedParameter('folder'))
 			));
+
+		// Ensure accepted is true for user and usergroup type
+		$qb->andWhere(
+			$qb->expr()->orX(
+				$qb->expr()->andX(
+					$qb->expr()->neq('share_type', $qb->createNamedParameter(IShare::TYPE_USER)),
+					$qb->expr()->neq('share_type', $qb->createNamedParameter(IShare::TYPE_USERGROUP)),
+				),
+				$qb->expr()->eq('accepted', $qb->createNamedParameter(IShare::STATUS_ACCEPTED, IQueryBuilder::PARAM_INT)),
+			),
+		);
+
 		$cursor = $qb->executeQuery();
 
 		$users = [];

tests/lib/Share20/DefaultShareProviderTest.php

@@ -2702,6 +2702,7 @@ public function testGetAccessListNoCurrentAccessRequired(): void {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_ALL);
 		$share1 = $this->provider->create($share1);
+		$share1 = $provider->acceptShare($share1, $u2->getUid());
 
 		$share2 = $shareManager->newShare();
 		$share2->setNode($folder2)
@@ -2714,6 +2715,9 @@ public function testGetAccessListNoCurrentAccessRequired(): void {
 
 		$shareManager->deleteFromSelf($share2, $u4->getUID());
 
+		$share2 = $provider->acceptShare($share2, $u3->getUid());
+		$share2 = $provider->acceptShare($share2, $u4->getUid());
+
 		$share3 = $shareManager->newShare();
 		$share3->setNode($file1)
 			->setSharedBy($u3->getUID())
@@ -2730,6 +2734,7 @@ public function testGetAccessListNoCurrentAccessRequired(): void {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_READ);
 		$share4 = $this->provider->create($share4);
+		$share4 = $provider->acceptShare($share4, $u5->getUid());
 
 		$result = $provider->getAccessList([$folder1, $folder2, $file1], false);
 
@@ -2800,6 +2805,7 @@ public function testGetAccessListCurrentAccessRequired(): void {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_ALL);
 		$share1 = $this->provider->create($share1);
+		$share1 = $provider->acceptShare($share1, $u2->getUid());
 
 		$share2 = $shareManager->newShare();
 		$share2->setNode($folder2)
@@ -2809,6 +2815,8 @@ public function testGetAccessListCurrentAccessRequired(): void {
 			->setShareType(IShare::TYPE_GROUP)
 			->setPermissions(\OCP\Constants::PERMISSION_ALL);
 		$share2 = $this->provider->create($share2);
+		$share2 = $provider->acceptShare($share2, $u3->getUid());
+		$share2 = $provider->acceptShare($share2, $u4->getUid());
 
 		$shareManager->deleteFromSelf($share2, $u4->getUID());
 
@@ -2828,6 +2836,7 @@ public function testGetAccessListCurrentAccessRequired(): void {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_READ);
 		$share4 = $this->provider->create($share4);
+		$share4 = $provider->acceptShare($share4, $u5->getUid());
 
 		$result = $provider->getAccessList([$folder1, $folder2, $file1], true);