upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

fix: don't put hashed password in share api response

Browse source 
Signed-off-by: Robin Appelman <robin@icewind.nl>
This commit is contained in:
Robin Appelman 2026-05-08 16:33:18 +02:00 committed by backportbot[bot]
parent a2eb38fefc
commit d3bccf9647
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
apps/files_sharing/lib/Controller/ShareAPIController.php
View file

@ -271,10 +271,10 @@ class ShareAPIController extends OCSController {
// "share_with" and "share_with_displayname" for passwords of link
// shares was deprecated in Nextcloud 15, use "password" instead.
$result['share_with'] = $share->getPassword();
$result['share_with'] = $this->formatPasswordField($share->getPassword());
$result['share_with_displayname'] = '(' . $this->l->t('Shared link') . ')';
$result['password'] = $share->getPassword();
$result['password'] = $this->formatPasswordField($share->getPassword());
$result['send_password_by_talk'] = $share->getSendPasswordByTalk();
@ -290,7 +290,7 @@ class ShareAPIController extends OCSController {
$result['token'] = $token;
} elseif ($share->getShareType() === IShare::TYPE_EMAIL) {
$result['share_with'] = $share->getSharedWith();
$result['password'] = $share->getPassword();
$result['password'] = $this->formatPasswordField($share->getPassword());
$result['password_expiration_time'] = $share->getPasswordExpirationTime() !== null ? $share->getPasswordExpirationTime()->format(\DateTime::ATOM) : null;
$result['send_password_by_talk'] = $share->getSendPasswordByTalk();
$result['share_with_displayname'] = $this->getDisplayNameFromAddressBook($share->getSharedWith(), 'EMAIL');
@ -359,6 +359,10 @@ class ShareAPIController extends OCSController {
return $result;
}
private function formatPasswordField(?string $password): ?string {
return ($password === null) ? null : 'redacted';
}
/**
* Check if one of the users address books knows the exact property, if
* not we return the full name.