upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-22 10:06:37 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 16

fix: don't put hashed password in share api response

Browse source 
Signed-off-by: Robin Appelman <robin@icewind.nl>
This commit is contained in:
Robin Appelman 2026-05-08 16:33:18 +02:00
parent 0a24ae518f
commit aa7e48e5e8
No known key found for this signature in database
GPG key ID: 42B69D8A64526EFB
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
apps/files_sharing/lib/Controller/ShareAPIController.php
View file

@ -273,10 +273,10 @@ class ShareAPIController extends OCSController {
// "share_with" and "share_with_displayname" for passwords of link
// shares was deprecated in Nextcloud 15, use "password" instead.
$result['share_with'] = $share->getPassword();
$result['share_with'] = $this->formatPasswordField($share->getPassword());
$result['share_with_displayname'] = '(' . $this->l->t('Shared link') . ')';
$result['password'] = $share->getPassword();
$result['password'] = $this->formatPasswordField($share->getPassword());
$result['send_password_by_talk'] = $share->getSendPasswordByTalk();
@ -292,7 +292,7 @@ class ShareAPIController extends OCSController {
$result['token'] = $token;
} elseif ($share->getShareType() === IShare::TYPE_EMAIL) {
$result['share_with'] = $share->getSharedWith();
$result['password'] = $share->getPassword();
$result['password'] = $this->formatPasswordField($share->getPassword());
$result['password_expiration_time'] = $share->getPasswordExpirationTime() !== null ? $share->getPasswordExpirationTime()->format(\DateTime::ATOM) : null;
$result['send_password_by_talk'] = $share->getSendPasswordByTalk();
$result['share_with_displayname'] = $this->getDisplayNameFromAddressBook($share->getSharedWith(), 'EMAIL');
@ -351,6 +351,10 @@ class ShareAPIController extends OCSController {
return $result;
}
private function formatPasswordField(?string $password): ?string {
return ($password === null) ? null : 'redacted';
}
/**
* Check if one of the users address books knows the exact property, if
* not we return the full name.