Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Respect user enumeration settings in user status lists #29260

Merged
merged 2 commits into from
Oct 20, 2021
Merged

Respect user enumeration settings in user status lists #29260

merged 2 commits into from
Oct 20, 2021

Commits on Oct 20, 2021

  1. Respect user enumeration settings in user status lists 

    So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <jonas@freesources.org>
    @mejo-
    mejo- committed Oct 20, 2021
    Configuration menu
    Copy the full SHA
    3fe267b View commit details
    Browse the repository at this point in the history

  2. Add integration tests for user_status API 

    Signed-off-by: Jonas Meurer <jonas@freesources.org>
    @mejo-
    mejo- committed Oct 20, 2021
    Configuration menu
    Copy the full SHA
    65cfe9d View commit details
    Browse the repository at this point in the history