From 18dddbc3b52ab646eb5bcf884f54556a6e24e55a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <come.chilliet@nextcloud.com>
Date: Tue, 7 Apr 2026 16:23:22 +0200
Subject: [PATCH] fix: Remove static var is Access class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It’s actually more correct to cache this per-instance.
What’s less clear is whether this can always fit in memory.

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
---
 apps/user_ldap/lib/Access.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php
index b693c693c92..8b82b607774 100644
--- a/apps/user_ldap/lib/Access.php
+++ b/apps/user_ldap/lib/Access.php
@@ -49,6 +49,7 @@ class Access extends LDAPUtility {
 	protected $groupMapper;
 
 	private string $lastCookie = '';
+	private array $intermediates = [];
 
 	public function __construct(
 		ILDAPWrapper $ldap,
@@ -484,8 +485,7 @@ class Access extends LDAPUtility {
 	 * @throws \Exception
 	 */
 	public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, ?array $record = null, bool $autoMapping = true) {
-		static $intermediates = [];
-		if (isset($intermediates[($isUser ? 'user-' : 'group-') . $fdn])) {
+		if (isset($this->intermediates[($isUser ? 'user-' : 'group-') . $fdn])) {
 			return false; // is a known intermediate
 		}
 
@@ -532,7 +532,7 @@ class Access extends LDAPUtility {
 			$record = $this->readAttributes($fdn, $attributesToRead, $filter);
 			if ($record === false) {
 				$this->logger->debug('Cannot read attributes for ' . $fdn . '. Skipping.', ['filter' => $filter]);
-				$intermediates[($isUser ? 'user-' : 'group-') . $fdn] = true;
+				$this->intermediates[($isUser ? 'user-' : 'group-') . $fdn] = true;
 				return false;
 			}
 		}
@@ -579,7 +579,7 @@ class Access extends LDAPUtility {
 				$ldapName = $record[$nameAttribute];
 				if (!isset($ldapName[0]) || empty($ldapName[0])) {
 					$this->logger->debug('No or empty name for ' . $fdn . ' with filter ' . $filter . '.', ['app' => 'user_ldap']);
-					$intermediates['group-' . $fdn] = true;
+					$this->intermediates['group-' . $fdn] = true;
 					return false;
 				}
 				$ldapName = $ldapName[0];