Skip to content

Do not allow invalid users to be created #14652

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nickvergessen merged 1 commit into from
Mar 14, 2019
Merged

Do not allow invalid users to be created #14652

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions lib/private/User/Manager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,6 +279,10 @@ public function searchDisplayName($pattern, $limit = null, $offset = null) {
* @return bool|IUser the created user or false
*/
public function createUser($uid, $password) {
if (!$this->verifyUid($uid)) {
return false;
}

$localBackends = [];
foreach ($this->backends as $backend) {
if ($backend instanceof Database) {
Expand Down Expand Up @@ -598,4 +602,14 @@ public function getByEmail($email) {
return ($u instanceof IUser);
}));
}

private function verifyUid(string $uid): bool {
$appdata = 'appdata_' . $this->config->getSystemValueString('instanceid');

if ($uid === '.htaccess' || $uid === 'files_external' || $uid === '.ocdata' || $uid === 'owncloud.log' || $uid === 'nextcloud.log' || $uid === $appdata) {
Copy link

@leonklingele-work leonklingele-work Mar 14, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not reject all UIDs for which there exists a file or folder in the data directory? Also, you forgot index.html, owncloud.db, owncloud.db-shm, owncloud.db-wal.

Copy link
Member

@MorrisJobke MorrisJobke Mar 14, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not reject all UIDs for which there exists a file or folder in the data directory?

We then need to first check the existing user as well, right?

Copy link

@leonklingele-work leonklingele-work Mar 15, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand.. What do you want to check, when?

Copy link
Member

@MorrisJobke MorrisJobke Mar 15, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

because otherwise a valid UID is not valid anymore once the user is created and thus has a user folder in there.

Copy link

@leonklingele-work leonklingele-work Mar 15, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the problem about having existing users with an invalid UID (which was valid before)?

Copy link
Member

@leonklingele leonklingele Apr 11, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, what about those additional files? And Why not reject all UIDs for which there exists a file or folder in the data directory??

Copy link
Member

@MorrisJobke MorrisJobke Apr 11, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, what about those additional files? And Why not reject all UIDs for which there exists a file or folder in the data directory??

Makes sense 👍 We should additionally keep the list here to avoid future collisions for not yet created log files or something like that.

Copy link

@leonklingele-work leonklingele-work Jun 17, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey, has this been implemented already?

Copy link
Member

@MorrisJobke MorrisJobke Jul 2, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No - mind to open a ticket?

Copy link

@leonklingele-work leonklingele-work Jul 2, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#16196

return false;
}

return true;
}
}