You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When a user has an email address set in her profile users in other groups can see her full name and email address through the sharing dropdown of the details view of the Files app even if "Restrict users to only share with users in their groups" is enabled in the "Sharing" section of the administration settings.
It seems that getEmail in apps/files_sharing/lib/Controller/ShareesAPIController.php does not honour the shareapi_only_share_with_group_members configuration value.
Steps to reproduce
Log in as the admin and enable "Restrict users to only share with users in their groups" in the "Sharing" section of the administration settings
Create a user group1-user1 belonging to group group1
Create a user group2-user2 belonging to group group2
Log in as user group1-user1, open the "Personal info" section of the settings, and set the full name to group1-fullname1 and the email address to group1-mail1@settings.com
Log in as user group2-user2 and open the "Sharing" tab of the details view of the Files app
In the sharing input field, type full or mail
Expected behaviour
No result appears in the sharing dropdown (like what happens after #5585 if full or mail is typed in the contacts menu instead).
Actual behaviour
In both cases, "group1-fullname1 (group1-mail1@settings.com)" appears in the dropdown, although that user belongs to a different group than the current user.
The text was updated successfully, but these errors were encountered:
Sorry for reopening, but I just noticed that the dropdown still leaks data on nextcloud 12.05 It still autocompletes usernames (LDAP) even though autocompletion has been disabled in sharing settings.
When a user has an email address set in her profile users in other groups can see her full name and email address through the sharing dropdown of the details view of the Files app even if "Restrict users to only share with users in their groups" is enabled in the "Sharing" section of the administration settings.
It seems that getEmail in apps/files_sharing/lib/Controller/ShareesAPIController.php does not honour the shareapi_only_share_with_group_members configuration value.
Steps to reproduce
Expected behaviour
No result appears in the sharing dropdown (like what happens after #5585 if full or mail is typed in the contacts menu instead).
Actual behaviour
In both cases, "group1-fullname1 (group1-mail1@settings.com)" appears in the dropdown, although that user belongs to a different group than the current user.
The text was updated successfully, but these errors were encountered: