Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sharing dropdown leaks email addresses of users in other groups #6530

Closed
danxuliu opened this issue Sep 16, 2017 · 4 comments
Closed

Sharing dropdown leaks email addresses of users in other groups #6530

danxuliu opened this issue Sep 16, 2017 · 4 comments

Comments

@danxuliu
Copy link
Member

When a user has an email address set in her profile users in other groups can see her full name and email address through the sharing dropdown of the details view of the Files app even if "Restrict users to only share with users in their groups" is enabled in the "Sharing" section of the administration settings.

It seems that getEmail in apps/files_sharing/lib/Controller/ShareesAPIController.php does not honour the shareapi_only_share_with_group_members configuration value.

Steps to reproduce

  1. Log in as the admin and enable "Restrict users to only share with users in their groups" in the "Sharing" section of the administration settings
  2. Create a user group1-user1 belonging to group group1
  3. Create a user group2-user2 belonging to group group2
  4. Log in as user group1-user1, open the "Personal info" section of the settings, and set the full name to group1-fullname1 and the email address to group1-mail1@settings.com
  5. Log in as user group2-user2 and open the "Sharing" tab of the details view of the Files app
  6. In the sharing input field, type full or mail

Expected behaviour

No result appears in the sharing dropdown (like what happens after #5585 if full or mail is typed in the contacts menu instead).

Actual behaviour

In both cases, "group1-fullname1 (group1-mail1@settings.com)" appears in the dropdown, although that user belongs to a different group than the current user.

@BornToBeRoot
Copy link

Will this be fixed in NC12 ?

@danxuliu
Copy link
Member Author

Will this be fixed in NC12 ?

Yes, once fixed for Nextcloud 13 it should be backported to Nextcloud 12.

@LEDfan
Copy link
Member

LEDfan commented Jan 29, 2018

This is the same bug which caused #7428 and is fixed in Nextcloud 12.0.5 and NC 13 beta 4.

@LEDfan LEDfan closed this as completed Jan 29, 2018
@muppeth
Copy link

muppeth commented Mar 1, 2018

Sorry for reopening, but I just noticed that the dropdown still leaks data on nextcloud 12.05 It still autocompletes usernames (LDAP) even though autocompletion has been disabled in sharing settings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants