upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-22 23:03:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 54

Only expose storage location to admins

Browse source 
Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
This commit is contained in:
Vincent Petry 2023-01-11 15:34:07 +01:00 committed by Vincent Petry (Rebase PR Action)
parent 143eaa43c3
commit a0fad7085a
2 changed files with 16 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
apps/provisioning_api/lib/Controller/AUserData.php
View file

@ -104,6 +104,7 @@ abstract class AUserData extends OCSController {
*/
protected function getUserData(string $userId, bool $includeScopes = false): array {
$currentLoggedInUser = $this->userSession->getUser();
assert($currentLoggedInUser !== null, 'No user logged in');
$data = [];
@ -113,8 +114,8 @@ abstract class AUserData extends OCSController {
throw new OCSNotFoundException('User does not exist');
}
// Should be at least Admin Or SubAdmin!
if ($this->groupManager->isAdmin($currentLoggedInUser->getUID())
$isAdmin = $this->groupManager->isAdmin($currentLoggedInUser->getUID());
if ($isAdmin
|| $this->groupManager->getSubAdmin()->isUserAccessible($currentLoggedInUser, $targetUserObject)) {
$data['enabled'] = $this->config->getUserValue($targetUserObject->getUID(), 'core', 'enabled', 'true') === 'true';
} else {
@ -132,13 +133,15 @@ abstract class AUserData extends OCSController {
$gids[] = $group->getGID();
}
try {
# might be thrown by LDAP due to handling of users disappears
# from the external source (reasons unknown to us)
# cf. https://github.com/nextcloud/server/issues/12991
$data['storageLocation'] = $targetUserObject->getHome();
} catch (NoUserException $e) {
throw new OCSNotFoundException($e->getMessage(), $e);
if ($isAdmin) {
try {
# might be thrown by LDAP due to handling of users disappears
# from the external source (reasons unknown to us)
# cf. https://github.com/nextcloud/server/issues/12991
$data['storageLocation'] = $targetUserObject->getHome();
} catch (NoUserException $e) {
throw new OCSNotFoundException($e->getMessage(), $e);
}
}
// Find the data

12
apps/provisioning_api/tests/Controller/UsersControllerTest.php
View file

@ -1163,9 +1163,8 @@ class UsersControllerTest extends TestCase {
->method('getDisplayName')
->willReturn('Demo User');
$targetUser
->expects($this->once())
->method('getHome')
->willReturn('/var/www/newtcloud/data/UID');
->expects($this->never())
->method('getHome');
$targetUser
->expects($this->once())
->method('getLastLogin')
@ -1203,7 +1202,6 @@ class UsersControllerTest extends TestCase {
$expected = [
'id' => 'UID',
'enabled' => true,
'storageLocation' => '/var/www/newtcloud/data/UID',
'lastLogin' => 1521191471000,
'backend' => 'Database',
'subadmin' => [],
@ -1345,9 +1343,8 @@ class UsersControllerTest extends TestCase {
->method('getUID')
->willReturn('UID');
$targetUser
->expects($this->once())
->method('getHome')
->willReturn('/var/www/newtcloud/data/UID');
->expects($this->never())
->method('getHome');
$targetUser
->expects($this->once())
->method('getLastLogin')
@ -1380,7 +1377,6 @@ class UsersControllerTest extends TestCase {
$expected = [
'id' => 'UID',
'storageLocation' => '/var/www/newtcloud/data/UID',
'lastLogin' => 1521191471000,
'backend' => 'Database',
'subadmin' => [],