Skip to content

Commit c903fb4

Browse files
CarlSchwanPVince81
CarlSchwan
and
PVince81
committed
Allow to disable password policy enforcement for selected groups
Signed-off-by: Carl Schwan <[email protected]> Co-authored-by: Vincent Petry <[email protected]>
1 parent 8a52591 commit c903fb4

File tree

12 files changed

+89
-13
lines changed

12 files changed

+89
-13
lines changed

‎apps/files_sharing/tests/CapabilitiesTest.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@ public function testOnlyLinkSharing() {
139139
$map = [
140140
['core', 'shareapi_enabled', 'yes', 'yes'],
141141
['core', 'shareapi_allow_links', 'yes', 'yes'],
142+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
142143
];
143144
$result = $this->getResults($map);
144145
$this->assertIsArray($result['public']);
@@ -149,6 +150,7 @@ public function testLinkPassword() {
149150
$map = [
150151
['core', 'shareapi_enabled', 'yes', 'yes'],
151152
['core', 'shareapi_allow_links', 'yes', 'yes'],
153+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
152154
['core', 'shareapi_enforce_links_password', 'no', 'yes'],
153155
];
154156
$result = $this->getResults($map);
@@ -161,6 +163,7 @@ public function testLinkNoPassword() {
161163
$map = [
162164
['core', 'shareapi_enabled', 'yes', 'yes'],
163165
['core', 'shareapi_allow_links', 'yes', 'yes'],
166+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
164167
['core', 'shareapi_enforce_links_password', 'no', 'no'],
165168
];
166169
$result = $this->getResults($map);
@@ -174,6 +177,7 @@ public function testLinkNoExpireDate() {
174177
['core', 'shareapi_enabled', 'yes', 'yes'],
175178
['core', 'shareapi_allow_links', 'yes', 'yes'],
176179
['core', 'shareapi_default_expire_date', 'no', 'no'],
180+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
177181
];
178182
$result = $this->getResults($map);
179183
$this->assertArrayHasKey('expire_date', $result['public']);
@@ -188,6 +192,7 @@ public function testLinkExpireDate() {
188192
['core', 'shareapi_default_expire_date', 'no', 'yes'],
189193
['core', 'shareapi_expire_after_n_days', '7', '7'],
190194
['core', 'shareapi_enforce_expire_date', 'no', 'no'],
195+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
191196
];
192197
$result = $this->getResults($map);
193198
$this->assertArrayHasKey('expire_date', $result['public']);
@@ -203,6 +208,7 @@ public function testLinkExpireDateEnforced() {
203208
['core', 'shareapi_allow_links', 'yes', 'yes'],
204209
['core', 'shareapi_default_expire_date', 'no', 'yes'],
205210
['core', 'shareapi_enforce_expire_date', 'no', 'yes'],
211+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
206212
];
207213
$result = $this->getResults($map);
208214
$this->assertArrayHasKey('expire_date', $result['public']);
@@ -215,6 +221,7 @@ public function testLinkSendMail() {
215221
['core', 'shareapi_enabled', 'yes', 'yes'],
216222
['core', 'shareapi_allow_links', 'yes', 'yes'],
217223
['core', 'shareapi_allow_public_notification', 'no', 'yes'],
224+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
218225
];
219226
$result = $this->getResults($map);
220227
$this->assertTrue($result['public']['send_mail']);
@@ -225,6 +232,7 @@ public function testLinkNoSendMail() {
225232
['core', 'shareapi_enabled', 'yes', 'yes'],
226233
['core', 'shareapi_allow_links', 'yes', 'yes'],
227234
['core', 'shareapi_allow_public_notification', 'no', 'no'],
235+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
228236
];
229237
$result = $this->getResults($map);
230238
$this->assertFalse($result['public']['send_mail']);
@@ -234,6 +242,7 @@ public function testResharing() {
234242
$map = [
235243
['core', 'shareapi_enabled', 'yes', 'yes'],
236244
['core', 'shareapi_allow_resharing', 'yes', 'yes'],
245+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
237246
];
238247
$result = $this->getResults($map);
239248
$this->assertTrue($result['resharing']);
@@ -243,6 +252,7 @@ public function testNoResharing() {
243252
$map = [
244253
['core', 'shareapi_enabled', 'yes', 'yes'],
245254
['core', 'shareapi_allow_resharing', 'yes', 'no'],
255+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
246256
];
247257
$result = $this->getResults($map);
248258
$this->assertFalse($result['resharing']);
@@ -253,6 +263,7 @@ public function testLinkPublicUpload() {
253263
['core', 'shareapi_enabled', 'yes', 'yes'],
254264
['core', 'shareapi_allow_links', 'yes', 'yes'],
255265
['core', 'shareapi_allow_public_upload', 'yes', 'yes'],
266+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
256267
];
257268
$result = $this->getResults($map);
258269
$this->assertTrue($result['public']['upload']);
@@ -264,6 +275,7 @@ public function testLinkNoPublicUpload() {
264275
['core', 'shareapi_enabled', 'yes', 'yes'],
265276
['core', 'shareapi_allow_links', 'yes', 'yes'],
266277
['core', 'shareapi_allow_public_upload', 'yes', 'no'],
278+
['core', 'shareapi_enforce_links_password_excluded_groups', '', ''],
267279
];
268280
$result = $this->getResults($map);
269281
$this->assertFalse($result['public']['upload']);

‎apps/settings/lib/Settings/Admin/Sharing.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,11 @@ public function getForm() {
7272
$linksExcludeGroupsList = !is_null(json_decode($linksExcludedGroups))
7373
? implode('|', json_decode($linksExcludedGroups, true)) : '';
7474

75+
$excludedPasswordGroups = $this->config->getAppValue('core', 'shareapi_enforce_links_password_excluded_groups', '');
76+
$excludedPasswordGroupsList = !is_null(json_decode($excludedPasswordGroups))
77+
? implode('|', json_decode($excludedPasswordGroups, true)) : '';
78+
79+
7580
$parameters = [
7681
// Built-In Sharing
7782
'sharingAppEnabled' => $this->appManager->isEnabledForUser('files_sharing'),
@@ -84,7 +89,9 @@ public function getForm() {
8489
'restrictUserEnumerationToGroup' => $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_group', 'no'),
8590
'restrictUserEnumerationToPhone' => $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_phone', 'no'),
8691
'restrictUserEnumerationFullMatch' => $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match', 'yes'),
87-
'enforceLinkPassword' => Util::isPublicLinkPasswordRequired(),
92+
'enforceLinkPassword' => Util::isPublicLinkPasswordRequired(false),
93+
'passwordExcludedGroups' => $excludedPasswordGroupsList,
94+
'passwordExcludedGroupsFeatureEnabled' => $this->config->getSystemValueBool('sharing.allow_disabled_password_enforcement_groups', false),
8895
'onlyShareWithGroupMembers' => $this->shareManager->shareWithGroupMembersOnly(),
8996
'shareAPIEnabled' => $this->config->getAppValue('core', 'shareapi_enabled', 'yes'),
9097
'shareDefaultExpireDateSet' => $this->config->getAppValue('core', 'shareapi_default_expire_date', 'no'),

‎apps/settings/src/admin.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import $ from 'jquery'
22
import 'jquery-ui-dist/jquery-ui'
33

44
window.addEventListener('DOMContentLoaded', () => {
5-
$('#excludedGroups,#linksExcludedGroups').each((index, element) => {
5+
$('#excludedGroups,#linksExcludedGroups,#passwordsExcludedGroups').each(function(index, element) {
66
OC.Settings.setupGroupsSelect($(element))
77
$(element).change((ev) => {
88
let groups = ev.val || []
@@ -96,6 +96,10 @@ window.addEventListener('DOMContentLoaded', () => {
9696
$('#setDefaultRemoteExpireDate').toggleClass('hidden', !this.checked)
9797
})
9898

99+
$('#enforceLinkPassword').change(function() {
100+
$('#selectPasswordsExcludedGroups').toggleClass('hidden', !this.checked)
101+
})
102+
99103
$('#publicShareDisclaimer').change(function() {
100104
$('#publicShareDisclaimerText').toggleClass('hidden', !this.checked)
101105
if (!this.checked) {

‎apps/settings/templates/settings/admin/sharing.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,18 @@
120120
} ?> />
121121
<label for="enforceLinkPassword"><?php p($l->t('Enforce password protection'));?></label><br/>
122122

123+
<?php if ($_['passwordExcludedGroupsFeatureEnabled']) { ?>
124+
<div id="selectPasswordsExcludedGroups" class="indent <?php if (!$_['enforceLinkPassword']) { p('hidden'); } ?>">
125+
<div class="indent">
126+
<label for="shareapi_enforce_links_password_excluded_groups"><?php p($l->t('Exclude groups from password requirements:'));?>
127+
<br />
128+
<input name="shareapi_enforce_links_password_excluded_groups" id="passwordsExcludedGroups" value="<?php p($_['passwordExcludedGroups']) ?>" style="width: 400px" class="noJSAutoUpdate"/>
129+
</div>
130+
</div>
131+
<?php } ?>
132+
133+
<input type="checkbox" name="shareapi_default_expire_date" id="shareapiDefaultExpireDate" class="checkbox" value="1" <?php if ($_['shareDefaultExpireDateSet'] === 'yes') { print_unescaped('checked="checked"'); } ?> />
134+
123135
<input type="checkbox" name="shareapi_default_expire_date" id="shareapiDefaultExpireDate" class="checkbox"
124136
value="1" <?php if ($_['shareDefaultExpireDateSet'] === 'yes') {
125137
print_unescaped('checked="checked"');

‎config/config.sample.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1560,6 +1560,11 @@
15601560
*/
15611561
'sharing.enable_share_mail' => true,
15621562

1563+
/**
1564+
* Set to true to enable the feature to add exceptions for share password enforcement
1565+
*/
1566+
'sharing.allow_disabled_password_enforcement_groups' => false,
1567+
15631568
/**
15641569
* Set to true to always transfer incoming shares by default
15651570
* when running "occ files:transfer-ownership".

‎dist/settings-legacy-admin.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/settings-legacy-admin.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/private/Share20/Manager.php‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1784,9 +1784,21 @@ public function shareApiAllowLinks() {
17841784
/**
17851785
* Is password on public link requires
17861786
*
1787+
* @param bool Check group membership exclusion
17871788
* @return bool
17881789
*/
1789-
public function shareApiLinkEnforcePassword() {
1790+
public function shareApiLinkEnforcePassword(bool $checkGroupMembership = true) {
1791+
$excludedGroups = $this->config->getAppValue('core', 'shareapi_enforce_links_password_excluded_groups', '');
1792+
if ($excludedGroups !== '' && $checkGroupMembership) {
1793+
$excludedGroups = json_decode($excludedGroups);
1794+
$user = $this->userSession->getUser();
1795+
if ($user) {
1796+
$userGroups = $this->groupManager->getUserGroupIds($user);
1797+
if ((bool)array_intersect($excludedGroups, $userGroups)) {
1798+
return false;
1799+
}
1800+
}
1801+
}
17901802
return $this->config->getAppValue('core', 'shareapi_enforce_links_password', 'no') === 'yes';
17911803
}
17921804

‎lib/private/legacy/OC_Util.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -348,15 +348,16 @@ public static function setupFS(?string $user = '') {
348348
}
349349

350350
/**
351-
* check if a password is required for each public link
351+
* Check if a password is required for each public link
352352
*
353+
* @param bool $checkGroupMembership Check group membership exclusion
353354
* @return boolean
354355
* @suppress PhanDeprecatedFunction
355356
*/
356-
public static function isPublicLinkPasswordRequired() {
357+
public static function isPublicLinkPasswordRequired(bool $checkGroupMembership = true) {
357358
/** @var IManager $shareManager */
358359
$shareManager = \OC::$server->get(IManager::class);
359-
return $shareManager->shareApiLinkEnforcePassword();
360+
return $shareManager->shareApiLinkEnforcePassword($checkGroupMembership);
360361
}
361362

362363
/**

‎lib/public/Share/IManager.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -317,10 +317,12 @@ public function shareApiAllowLinks();
317317
/**
318318
* Is password on public link requires
319319
*
320+
* @param bool $checkGroupMembership Check group membership exclusion
320321
* @return bool
321322
* @since 9.0.0
323+
* @since 24.0.0 Added optional $checkGroupMembership parameter
322324
*/
323-
public function shareApiLinkEnforcePassword();
325+
public function shareApiLinkEnforcePassword(bool $checkGroupMembership = true);
324326

325327
/**
326328
* Is default expire date enabled

0 commit comments

Comments
 (0)