You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
nextcloud/apps/user_status/lib
Jonas Meurer 50a25748c0
Respect user enumeration settings in user status lists
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
https://github.com/nextcloud/server/pull/27879#pullrequestreview-753655308
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <jonas@freesources.org>
3 years ago
..
AppInfo Respect user enumeration settings in user status lists 3 years ago
BackgroundJob Better cleanup routine for statuses 4 years ago
Connector Always use IUserStatus consts 4 years ago
Controller UserStatus: no message means clear status message. This fixes #23332 4 years ago
Dashboard Always use IUserStatus consts 4 years ago
Db Don't update statuses to offline again and again 3 years ago
Exception Add user-status app 4 years ago
Listener Only load user status script when needed 4 years ago
Migration Make is_user_defined nullable so we can store false on oracle 4 years ago
Service Respect user enumeration settings in user status lists 3 years ago
Capabilities.php Add user-status app 4 years ago