diff --git a/build/integration/features/bootstrap/ShareesContext.php b/build/integration/features/bootstrap/ShareesContext.php index 3539bf34598a9..dcd2e9a72e32b 100644 --- a/build/integration/features/bootstrap/ShareesContext.php +++ b/build/integration/features/bootstrap/ShareesContext.php @@ -27,6 +27,7 @@ protected function resetAppConfigs() { $this->deleteServerConfig('core', 'shareapi_only_share_with_group_members'); $this->deleteServerConfig('core', 'shareapi_only_share_with_group_members_exclude_group_list'); $this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match'); + $this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_displayname'); $this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_email'); $this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_dn'); $this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_user_id'); diff --git a/build/integration/sharees_features/sharees_user.feature b/build/integration/sharees_features/sharees_user.feature index e5ed0c28bf264..a6e5443c67419 100644 --- a/build/integration/sharees_features/sharees_user.feature +++ b/build/integration/sharees_features/sharees_user.feature @@ -394,6 +394,40 @@ Feature: sharees_user | Test One (Second displayname for user 1) | 0 | test1 | test1 | And "users" sharees returned is empty + Scenario: Search for displayname returns nothing without sharee enumeration and without full match displayname enumeration + Given user "test" with displayname "foo" exists + And user "test1" with displayname "Test One" exists + And user "test2" with displayname "Test Two" exists + And group "groupA" exists + And user "test" belongs to group "groupA" + And user "test1" belongs to group "groupA" + And user "test2" belongs to group "groupA" + And As an "test" + And parameter "shareapi_allow_share_dialog_user_enumeration" of app "core" is set to "no" + And parameter "shareapi_restrict_user_enumeration_full_match_displayname" of app "core" is set to "no" + When getting sharees for + | search | Test One | + | itemType | file | + Then the OCS status code should be "100" + And the HTTP status code should be "200" + And "exact users" sharees returned is empty + And "users" sharees returned is empty + + Scenario: Search for exact userid returns exact user without sharee enumeration and without full match displayname enumeration + Given user "test" with displayname "foo" exists + And user "test1" with displayname "Test One" exists + And As an "test" + And parameter "shareapi_allow_share_dialog_user_enumeration" of app "core" is set to "no" + And parameter "shareapi_restrict_user_enumeration_full_match_displayname" of app "core" is set to "no" + When getting sharees for + | search | test1 | + | itemType | file | + Then the OCS status code should be "100" + And the HTTP status code should be "200" + And "exact users" sharees returned are + | Test One | 0 | test1 | test1 | + And "users" sharees returned is empty + Scenario: Search for exact userid with shared group returns exact user with sharee enumeration limited to group Given user "test" with displayname "foo" exists And user "test1" exists diff --git a/lib/private/Collaboration/Collaborators/UserPlugin.php b/lib/private/Collaboration/Collaborators/UserPlugin.php index 9ccdfc6b67a17..bd03469970169 100644 --- a/lib/private/Collaboration/Collaborators/UserPlugin.php +++ b/lib/private/Collaboration/Collaborators/UserPlugin.php @@ -105,14 +105,17 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b $shareeEnumerationFullMatch = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match', 'yes') === 'yes'; if ($shareeEnumerationFullMatch && $search !== '') { $shareeEnumerationFullMatchUserId = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_user_id', 'yes') === 'yes'; + $shareeEnumerationFullMatchDisplayName = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_displayname', 'yes') === 'yes'; $shareeEnumerationFullMatchEmail = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_email', 'yes') === 'yes'; $shareeEnumerationFullMatchIgnoreSecondDisplayName = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_dn', 'no') === 'yes'; - // Re-use the results from earlier if possible - $usersByDisplayName ??= $this->userManager->searchDisplayName($search, $limit, $offset); - foreach ($usersByDisplayName as $user) { - if ($user->isEnabled() && (mb_strtolower($user->getDisplayName()) === $lowerSearch || ($shareeEnumerationFullMatchIgnoreSecondDisplayName && trim(mb_strtolower(preg_replace('/ \(.*\)$/', '', $user->getDisplayName()))) === $lowerSearch))) { - $users[$user->getUID()] = ['exact', $user]; + if ($shareeEnumerationFullMatchDisplayName) { + // Re-use the results from earlier if possible + $usersByDisplayName ??= $this->userManager->searchDisplayName($search, $limit, $offset); + foreach ($usersByDisplayName as $user) { + if ($user->isEnabled() && (mb_strtolower($user->getDisplayName()) === $lowerSearch || ($shareeEnumerationFullMatchIgnoreSecondDisplayName && trim(mb_strtolower(preg_replace('/ \(.*\)$/', '', $user->getDisplayName()))) === $lowerSearch))) { + $users[$user->getUID()] = ['exact', $user]; + } } }