From 4b50b87c5550b18ebddc5496c53ccd5216261176 Mon Sep 17 00:00:00 2001 From: David Dreschner Date: Fri, 10 Jul 2026 14:27:16 +0200 Subject: [PATCH] fix(shareapi): Check if the returned user id matches the searched one Assisted-by: ClaudeCode:claude-fable-5 Signed-off-by: David Dreschner --- .../sharees_features/sharees.feature | 34 +++++++++++++++++++ .../Collaborators/UserPlugin.php | 5 ++- 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/build/integration/sharees_features/sharees.feature b/build/integration/sharees_features/sharees.feature index d1c3c95628d62..b54440866a9c0 100644 --- a/build/integration/sharees_features/sharees.feature +++ b/build/integration/sharees_features/sharees.feature @@ -426,6 +426,40 @@ Feature: sharees And "exact emails" sharees returned is empty And "emails" sharees returned is empty + Scenario: Search user by system e-mail address with e-mail full match disabled + Given As an "test" + And parameter "shareapi_restrict_user_enumeration_full_match_email" of app "core" is set to "no" + When getting sharees for + | search | sharee2@system.com | + | itemType | file | + | shareType | 0 | + Then the OCS status code should be "100" + And the HTTP status code should be "200" + And "exact users" sharees returned is empty + # With enumeration allowed the user is still found as non-exact match, as + # enumeration also searches in the e-mail address + And "users" sharees returned are + | Sharee2 | 0 | Sharee2 | sharee2@system.com | + And "exact emails" sharees returned is empty + And "emails" sharees returned is empty + + Scenario: Search user by system e-mail address with e-mail full match and user enumeration disabled + Given As an "test" + And parameter "shareapi_restrict_user_enumeration_full_match_email" of app "core" is set to "no" + And parameter "shareapi_allow_share_dialog_user_enumeration" of app "core" is set to "no" + When getting sharees for + | search | sharee2@system.com | + | itemType | file | + | shareType | 0 | + Then the OCS status code should be "100" + And the HTTP status code should be "200" + # The user id full match must not resolve e-mail addresses through the user + # backends (login via e-mail address) + And "exact users" sharees returned is empty + And "users" sharees returned is empty + And "exact emails" sharees returned is empty + And "emails" sharees returned is empty + Scenario: Search e-mail Given As an "test" When getting sharees for diff --git a/lib/private/Collaboration/Collaborators/UserPlugin.php b/lib/private/Collaboration/Collaborators/UserPlugin.php index 9ccdfc6b67a17..45298f0382961 100644 --- a/lib/private/Collaboration/Collaborators/UserPlugin.php +++ b/lib/private/Collaboration/Collaborators/UserPlugin.php @@ -118,7 +118,10 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b if ($shareeEnumerationFullMatchUserId) { $user = $this->userManager->get($search); - if ($user !== null) { + // User backends may also resolve email addresses or other login names here + // (e.g. for login via email). Only an actual user id match counts as user id + // full match, everything else is governed by the email setting below. + if ($user !== null && mb_strtolower($user->getUID()) === $lowerSearch) { $users[$user->getUID()] = ['exact', $user]; } }