ShareesAPIController should respect groups disallowed from sharing

apps/files_sharing/lib/Controller/ShareesAPIController.php

@@ -49,8 +49,10 @@
 use OCP\Collaboration\Collaborators\ISearchResult;
 use OCP\Collaboration\Collaborators\SearchResultType;
 use OCP\IConfig;
+use OCP\IGroupManager;
 use OCP\IRequest;
 use OCP\IURLGenerator;
+use OCP\IUserManager;
 use OCP\Share\IShare;
 use OCP\Share\IManager;
 use function usort;
@@ -103,6 +105,12 @@ class ShareesAPIController extends OCSController {
 	/** @var ISearch */
 	private $collaboratorSearch;
 
+	/** @var IGroupManager */
+	private $groupManager;
+
+	/** @var IUserManager */
+	private $userManager;
+
 	/**
 	 * @param string $UserId
 	 * @param string $appName
@@ -119,14 +127,20 @@ public function __construct(
 		IConfig $config,
 		IURLGenerator $urlGenerator,
 		IManager $shareManager,
-		ISearch $collaboratorSearch
+		ISearch $collaboratorSearch,
+		IGroupManager $groupManager,
+		IUserManager $userManager
+
 	) {
 		parent::__construct($appName, $request);
 		$this->userId = $UserId;
 		$this->config = $config;
 		$this->urlGenerator = $urlGenerator;
 		$this->shareManager = $shareManager;
 		$this->collaboratorSearch = $collaboratorSearch;
+		$this->groupManager = $groupManager;
+		$this->userManager = $userManager;
+
 	}
 
 	/**
@@ -143,6 +157,18 @@ public function __construct(
 	 */
 	public function search(string $search = '', string $itemType = null, int $page = 1, int $perPage = 200, $shareType = null, bool $lookup = true): DataResponse {
 
+		// if some groups are excluded, check the user is allowed to share
+		if ($this->config->getAppValue('core', 'shareapi_exclude_groups', 'no') === 'yes') {
+			$excludedGroups = $this->config->getAppValue('core', 'shareapi_exclude_groups_list', '');
+			$excludedGroupsArray = !is_null(json_decode($excludedGroups))
+				? json_decode($excludedGroups, true) : '';
+			$usersGroups = $this->groupManager->getUserGroupIds($this->userManager->get($this->userId));
+			if (array_intersect($usersGroups, $excludedGroupsArray) == $usersGroups) {
+				return new DataResponse($this->result);
+			}
+		}
+
+
 		// only search for string larger than a given threshold
 		$threshold = (int)$this->config->getSystemValue('sharing.minSearchStringLength', 0);
 		if (strlen($search) < $threshold) {

apps/files_sharing/tests/Controller/ShareesAPIControllerTest.php

@@ -37,8 +37,10 @@
 use OCP\AppFramework\OCS\OCSBadRequestException;
 use OCP\Collaboration\Collaborators\ISearch;
 use OCP\IConfig;
+use OCP\IGroupManager;
 use OCP\IRequest;
 use OCP\IURLGenerator;
+use OCP\IUserManager;
 use OCP\Share\IShare;
 use OCP\Share\IManager;
 
@@ -65,6 +67,12 @@ class ShareesAPIControllerTest extends TestCase {
 	/** @var  ISearch|\PHPUnit\Framework\MockObject\MockObject */
 	protected $collaboratorSearch;
 
+	/** @var IGroupManager|\PHPUnit\Framework\MockObject\MockObject */
+	private $groupManager;
+
+	/** @var IUserManager|\PHPUnit\Framework\MockObject\MockObject */
+	private $userManager;
+
 	protected function setUp(): void {
 		parent::setUp();
 
@@ -80,14 +88,20 @@ protected function setUp(): void {
 
 		$this->collaboratorSearch = $this->createMock(ISearch::class);
 
+		$this->groupManager = $this->createMock(IGroupManager::class);
+
+		$this->userManager = $this->createMock(IUserManager::class);
+
 		$this->sharees = new ShareesAPIController(
 			$this->uid,
 			'files_sharing',
 			$this->request,
 			$configMock,
 			$urlGeneratorMock,
 			$this->shareManager,
-			$this->collaboratorSearch
+			$this->collaboratorSearch,
+			$this->groupManager,
+			$this->userManager
 		);
 	}
 
@@ -239,6 +253,8 @@ public function testSearch($getData, $apiSetting, $enumSetting, $remoteSharingEn
 
 		/** @var IConfig|\PHPUnit\Framework\MockObject\MockObject $config */
 		$config = $this->createMock(IConfig::class);
+
+		// TODO: Add exclude groups config request
 		$config->expects($this->exactly(1))
 			->method('getAppValue')
 			->with($this->anything(), $this->anything(), $this->anything())
@@ -266,7 +282,9 @@ public function testSearch($getData, $apiSetting, $enumSetting, $remoteSharingEn
 				$config,
 				$urlGenerator,
 				$this->shareManager,
-				$this->collaboratorSearch
+				$this->collaboratorSearch,
+				$this->groupManager,
+				$this->userManager
 			])
 			->setMethods(['isRemoteSharingAllowed', 'shareProviderExists', 'isRemoteGroupSharingAllowed'])
 			->getMock();
@@ -361,7 +379,9 @@ public function testSearchInvalid($getData, $message) {
 				$config,
 				$urlGenerator,
 				$this->shareManager,
-				$this->collaboratorSearch
+				$this->collaboratorSearch,
+				$this->groupManager,
+				$this->userManager
 			])
 			->setMethods(['isRemoteSharingAllowed'])
 			->getMock();