Skip to content

[stable19] Do not match sharees on an empty email address #23090

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rullzer merged 1 commit into from
Oct 1, 2020
Merged

[stable19] Do not match sharees on an empty email address #23090

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Do not match sharees on an empty email address 
When asking for sharees we compare not only UID and displayname but also
the email address. And if that matches we return the sharee as an exact
match. This logic had a flaw as in that it also matched the empty string
to users with no email address.

This is most noticeable when you disable sharee enumeration and open the
ownership transfer dialog. It suggested other users of the instance
before. This has stopped now.

Signed-off-by: Christoph Wurst <[email protected]>
  • Loading branch information
@ChristophWurst @backportbot
ChristophWurst authored and backportbot[bot] committed Sep 29, 2020
commit 1c65d33e9ffa4d18f62ec5d4fd4cd08cddb236d1
4 changes: 2 additions & 2 deletions lib/private/Collaboration/Collaborators/UserPlugin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,9 +113,9 @@ public function search($search, $limit, $offset, ISearchResult $searchResult) {
$userEmail = $user->getEMailAddress();
$uid = (string) $uid;
if (
strtolower($uid) === $lowerSearch ||
$lowerSearch !== '' && (strtolower($uid) === $lowerSearch ||
strtolower($userDisplayName) === $lowerSearch ||
strtolower($userEmail) === $lowerSearch
strtolower($userEmail) === $lowerSearch)
) {
if (strtolower($uid) === $lowerSearch) {
$foundUserById = true;
Expand Down