Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport #29260: Respect user enumeration settings in user status lists #29428

Merged
merged 2 commits into from
Oct 25, 2021
Merged

Backport #29260: Respect user enumeration settings in user status lists #29428

merged 2 commits into from
Oct 25, 2021

Commits on Oct 25, 2021

  1. Respect user enumeration settings in user status lists 

    So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <jonas@freesources.org>
    @mejo-
    mejo- committed Oct 25, 2021
    Configuration menu
    Copy the full SHA
    02ce5c8 View commit details
    Browse the repository at this point in the history

  2. Add integration tests for user_status API 

    Signed-off-by: Jonas Meurer <jonas@freesources.org>
    @mejo-
    mejo- committed Oct 25, 2021
    Configuration menu
    Copy the full SHA
    e838e63 View commit details
    Browse the repository at this point in the history