From 70c56b411ee3eb20ebc206aa5cbf04254343f03f Mon Sep 17 00:00:00 2001 From: Louis Chemineau Date: Wed, 13 Apr 2022 15:07:27 +0200 Subject: [PATCH 1/2] Use share setting in DAV search shareapi_restrict_user_enumeration_full_match_ignore_second_display_name was introduced to ignore second display name during search from the share panel. But this setting was not respected by search from the calendar application. This fix it. Signed-off-by: Louis Chemineau --- apps/dav/lib/Connector/Sabre/Principal.php | 6 ++++-- lib/private/Share20/Manager.php | 4 ++++ lib/public/Share/IManager.php | 8 ++++++++ 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/apps/dav/lib/Connector/Sabre/Principal.php b/apps/dav/lib/Connector/Sabre/Principal.php index c3f06f95783a0..4c7f17f492986 100644 --- a/apps/dav/lib/Connector/Sabre/Principal.php +++ b/apps/dav/lib/Connector/Sabre/Principal.php @@ -270,6 +270,7 @@ protected function searchUserPrincipals(array $searchProperties, $test = 'allof' $limitEnumerationGroup = $this->shareManager->limitEnumerationToGroups(); $limitEnumerationPhone = $this->shareManager->limitEnumerationToPhone(); $allowEnumerationFullMatch = $this->shareManager->allowEnumerationFullMatch(); + $ignoreSecondDisplayName = $this->shareManager->ignoreSecondDisplayName(); // If sharing is restricted to group members only, // return only members that have groups in common @@ -349,8 +350,9 @@ protected function searchUserPrincipals(array $searchProperties, $test = 'allof' if ($allowEnumerationFullMatch) { $lowerSearch = strtolower($value); $users = $this->userManager->searchDisplayName($value, $searchLimit); - $users = \array_filter($users, static function (IUser $user) use ($lowerSearch) { - return strtolower($user->getDisplayName()) === $lowerSearch; + $users = \array_filter($users, static function (IUser $user) use ($lowerSearch, $ignoreSecondDisplayName) { + $lowerDisplayName = strtolower($user->getDisplayName()); + return $lowerDisplayName === $lowerSearch || ($ignoreSecondDisplayName && trim(preg_replace('/ \(.*\)$/', '', $lowerDisplayName)) === $lowerSearch); }); } else { $users = []; diff --git a/lib/private/Share20/Manager.php b/lib/private/Share20/Manager.php index aab69eae597eb..2a864bd62c71b 100644 --- a/lib/private/Share20/Manager.php +++ b/lib/private/Share20/Manager.php @@ -1963,6 +1963,10 @@ public function allowEnumerationFullMatch(): bool { return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match', 'yes') === 'yes'; } + public function ignoreSecondDisplayName(): bool { + return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_display_name', 'no') === 'yes'; + } + public function currentUserCanEnumerateTargetUser(?IUser $currentUser, IUser $targetUser): bool { if ($this->allowEnumerationFullMatch()) { return true; diff --git a/lib/public/Share/IManager.php b/lib/public/Share/IManager.php index f6b74c4de4a15..2963d8fd24b5b 100644 --- a/lib/public/Share/IManager.php +++ b/lib/public/Share/IManager.php @@ -454,6 +454,14 @@ public function limitEnumerationToPhone(): bool; */ public function allowEnumerationFullMatch(): bool; + /** + * Check if the search should ignore the second in parentheses display name if there is any + * + * @return bool + * @since 24.0.0 + */ + public function ignoreSecondDisplayName(): bool; + /** * Check if the current user can enumerate the target user * From e8ab298d2c718c0b6e671c127ffa51d840654cda Mon Sep 17 00:00:00 2001 From: Louis Chemineau Date: Tue, 19 Apr 2022 12:54:28 +0200 Subject: [PATCH 2/2] Use email settings in DAV search Signed-off-by: Louis Chemineau --- apps/dav/lib/Connector/Sabre/Principal.php | 3 ++- apps/dav/tests/unit/Connector/Sabre/PrincipalTest.php | 4 ++++ lib/private/Share20/Manager.php | 4 ++++ lib/public/Share/IManager.php | 10 +++++++++- 4 files changed, 19 insertions(+), 2 deletions(-) diff --git a/apps/dav/lib/Connector/Sabre/Principal.php b/apps/dav/lib/Connector/Sabre/Principal.php index 4c7f17f492986..94e3978e67d1a 100644 --- a/apps/dav/lib/Connector/Sabre/Principal.php +++ b/apps/dav/lib/Connector/Sabre/Principal.php @@ -271,6 +271,7 @@ protected function searchUserPrincipals(array $searchProperties, $test = 'allof' $limitEnumerationPhone = $this->shareManager->limitEnumerationToPhone(); $allowEnumerationFullMatch = $this->shareManager->allowEnumerationFullMatch(); $ignoreSecondDisplayName = $this->shareManager->ignoreSecondDisplayName(); + $matchEmail = $this->shareManager->matchEmail(); // If sharing is restricted to group members only, // return only members that have groups in common @@ -299,7 +300,7 @@ protected function searchUserPrincipals(array $searchProperties, $test = 'allof' switch ($prop) { case '{http://sabredav.org/ns}email-address': if (!$allowEnumeration) { - if ($allowEnumerationFullMatch) { + if ($allowEnumerationFullMatch && $matchEmail) { $users = $this->userManager->getByEmail($value); } else { $users = []; diff --git a/apps/dav/tests/unit/Connector/Sabre/PrincipalTest.php b/apps/dav/tests/unit/Connector/Sabre/PrincipalTest.php index d7c074c9e3b45..86413e4a366a5 100644 --- a/apps/dav/tests/unit/Connector/Sabre/PrincipalTest.php +++ b/apps/dav/tests/unit/Connector/Sabre/PrincipalTest.php @@ -662,6 +662,10 @@ public function testSearchPrincipalWithEnumerationDisabledEmail(): void { ->method('allowEnumerationFullMatch') ->willReturn(true); + $this->shareManager->expects($this->once()) + ->method('matchEmail') + ->willReturn(true); + $user2 = $this->createMock(IUser::class); $user2->method('getUID')->willReturn('user2'); $user2->method('getDisplayName')->willReturn('User 2'); diff --git a/lib/private/Share20/Manager.php b/lib/private/Share20/Manager.php index 2a864bd62c71b..eed86bb41c385 100644 --- a/lib/private/Share20/Manager.php +++ b/lib/private/Share20/Manager.php @@ -1963,6 +1963,10 @@ public function allowEnumerationFullMatch(): bool { return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match', 'yes') === 'yes'; } + public function matchEmail(): bool { + return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_email', 'yes') === 'yes'; + } + public function ignoreSecondDisplayName(): bool { return $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_display_name', 'no') === 'yes'; } diff --git a/lib/public/Share/IManager.php b/lib/public/Share/IManager.php index 2963d8fd24b5b..f207ca87a2c98 100644 --- a/lib/public/Share/IManager.php +++ b/lib/public/Share/IManager.php @@ -454,11 +454,19 @@ public function limitEnumerationToPhone(): bool; */ public function allowEnumerationFullMatch(): bool; + /** + * Check if the search should match the email + * + * @return bool + * @since 25.0.0 + */ + public function matchEmail(): bool; + /** * Check if the search should ignore the second in parentheses display name if there is any * * @return bool - * @since 24.0.0 + * @since 25.0.0 */ public function ignoreSecondDisplayName(): bool;