mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1870 from nextcloud/do-not-allow-sharee-enumeration-via-email-option 

Do not allow sharee enumeration via email option
This commit is contained in:
Roeland Jago Douma 2016-10-24 11:35:17 +02:00 committed by GitHub
parent 4db595181d f0f62aa055
commit 672c7f4e97
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
core/ajax/share.php
View File

@ -213,6 +213,7 @@ if (isset($_POST['action']) && isset($_POST['itemType']) && isset($_POST['itemSo
$result = array(); $result = array();
if (isset($_GET['search'])) { if (isset($_GET['search'])) {
$cm = OC::$server->getContactsManager(); $cm = OC::$server->getContactsManager();
$allowEnumeration = \OC::$server->getConfig()->getAppValue('core', 'shareapi_allow_share_dialog_user_enumeration', 'yes') === 'yes';
if (!is_null($cm) && $cm->isEnabled()) { if (!is_null($cm) && $cm->isEnabled()) {
$contacts = $cm->search((string)$_GET['search'], array('FN', 'EMAIL')); $contacts = $cm->search((string)$_GET['search'], array('FN', 'EMAIL'));
foreach ($contacts as $contact) { foreach ($contacts as $contact) {
@ -226,6 +227,13 @@ if (isset($_POST['action']) && isset($_POST['itemType']) && isset($_POST['itemSo
} }
foreach($emails as $email) { foreach($emails as $email) {
if (!$allowEnumeration &&
$email !== $_GET['search'] &&
$contact['FN'] !== $_GET['search']
) {
continue;
}
$result[] = array( $result[] = array(
'id' => $contact['id'], 'id' => $contact['id'],
'email' => $email, 'email' => $email,

2
core/js/sharedialogmailview.js
View File

@ -139,6 +139,8 @@
}, function(result) { }, function(result) {
if (result.status == 'success' && result.data.length > 0) { if (result.status == 'success' && result.data.length > 0) {
response(result.data); response(result.data);
} else {
response([]);
} }
}); });
}, },