upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-11 01:30:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 79

fix(contacts): Do not expose SAB in /contactsmenu

Browse source 
When hitting the `/contactsmenu/contacts` endpoint with the `dav.system_addressbook_exposed` config switch set to `"no"`, the system address book content is still listed in the response.

This ensure that we do not expose unexpectedly the system address book.

Signed-off-by: Louis Chmn <louis@chmn.me>
This commit is contained in:
Louis Chemineau 2025-09-18 12:22:43 +02:00 committed by Louis Chmn
parent 159ffe4b05
commit 860d84123f
3 changed files with 30 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
apps/dav/lib/CardDAV/ContactsManager.php
View file

@ -9,6 +9,7 @@ namespace OCA\DAV\CardDAV;
use OCA\DAV\Db\PropertyMapper;
use OCP\Contacts\IManager;
use OCP\IAppConfig;
use OCP\IL10N;
use OCP\IURLGenerator;
@ -23,6 +24,7 @@ class ContactsManager {
private CardDavBackend $backend,
private IL10N $l10n,
private PropertyMapper $propertyMapper,
private IAppConfig $appConfig,
) {
}
@ -43,6 +45,11 @@ class ContactsManager {
* @param IURLGenerator $urlGenerator
*/
public function setupSystemContactsProvider(IManager $cm, ?string $userId, IURLGenerator $urlGenerator) {
$systemAddressBookExposed = $this->appConfig->getValueBool('dav', 'system_addressbook_exposed', true);
if (!$systemAddressBookExposed) {
return;
}
$addressBooks = $this->backend->getAddressBooksForUser('principals/system/system');
$this->register($cm, $addressBooks, $urlGenerator, $userId);
}

9
apps/dav/tests/unit/CardDAV/ContactsManagerTest.php
View file

@ -11,6 +11,7 @@ use OCA\DAV\CardDAV\CardDavBackend;
use OCA\DAV\CardDAV\ContactsManager;
use OCA\DAV\Db\PropertyMapper;
use OCP\Contacts\IManager;
use OCP\IAppConfig;
use OCP\IL10N;
use OCP\IURLGenerator;
use Test\TestCase;
@ -19,7 +20,8 @@ class ContactsManagerTest extends TestCase {
public function test(): void {
/** @var IManager | \PHPUnit\Framework\MockObject\MockObject $cm */
$cm = $this->getMockBuilder(IManager::class)->disableOriginalConstructor()->getMock();
$cm->expects($this->exactly(2))->method('registerAddressBook');
$cm->expects($this->exactly(1))->method('registerAddressBook');
/** @var IURLGenerator&MockObject $urlGenerator */
$urlGenerator = $this->getMockBuilder(IURLGenerator::class)->disableOriginalConstructor()->getMock();
/** @var CardDavBackend | \PHPUnit\Framework\MockObject\MockObject $backEnd */
$backEnd = $this->getMockBuilder(CardDavBackend::class)->disableOriginalConstructor()->getMock();
@ -27,9 +29,12 @@ class ContactsManagerTest extends TestCase {
['{DAV:}displayname' => 'Test address book', 'uri' => 'default'],
]);
$propertyMapper = $this->createMock(PropertyMapper::class);
/** @var IAppConfig&MockObject $appConfig */
$appConfig = $this->createMock(IAppConfig::class);
/** @var IL10N&MockObject $l */
$l = $this->createMock(IL10N::class);
$app = new ContactsManager($backEnd, $l, $propertyMapper);
$app = new ContactsManager($backEnd, $l, $propertyMapper, $appConfig);
$app->setupContactsProvider($cm, 'user01', $urlGenerator);
}
}

16
build/integration/features/contacts-menu.feature
View file

@ -194,3 +194,19 @@ Feature: contacts-menu
And searching for contacts matching with "test"
# Disabled because it regularly fails on drone:
# Then the list of searched contacts has "0" contacts
Scenario: users cannot list other users from the system address book
Given user "user0" exists
And user "user1" exists
And invoking occ with "config:app:set dav system_addressbook_exposed --value false"
And Logging in using web as "user1"
And searching for contacts matching with ""
Then the list of searched contacts has "0" contacts
And invoking occ with "config:app:delete dav system_addressbook_exposed"
Scenario: users can list other users from the system address book
Given user "user0" exists
And user "user1" exists
And Logging in using web as "user1"
And searching for contacts matching with ""
Then the list of searched contacts has "1" contacts