Skip to content

NC12.0.4 - Sharing dialog leaks data with LDAP backend #7428

Description

@BornToBeRoot

Sharing dialog leaks data with LDAP backend.

Steps to reproduce

  1. Create some test users (local and in active directory)

image

  1. Logon with "Test321"-User

image

  1. Open share dialog and type "test"

image

Expected behaviour

test2 (LDAP/AD User) should not be listet, because he is not in the same group...

image

Sharing options

image

Actual behaviour

See "Steps to reproduce/3."

Server configuration

Operating system: CentOS 7

Web server: Apache

Database: MariaDB

PHP version: 7.0

Nextcloud version: 12.0.4 Build:2017-12-06T01:01:26+00:00 e04dd40

Updated from an older Nextcloud/ownCloud or fresh install: Owncloud --> [..] --> Update NC 11

Where did you install Nextcloud from: Nextcloud website / download

List of activated apps:

App list
 - activity: 2.5.2
  - admin_audit: 1.2.0
  - bruteforcesettings: 1.0.2
  - comments: 1.2.0
  - dav: 1.3.0
  - federatedfilesharing: 1.2.0
  - files: 1.7.2
  - files_antivirus: 1.1.0
  - files_downloadactivity: 1.1.1
  - files_pdfviewer: 1.1.1
  - files_sharing: 1.4.0
  - files_texteditor: 2.4.1
  - files_trashbin: 1.2.0
  - files_videoplayer: 1.1.0
  - gallery: 17.0.0
  - groupfolders: 1.1.0
  - impersonate: 1.0.1
  - logreader: 2.0.0
  - lookup_server_connector: 1.0.0
  - music: 0.5.4
  - notifications: 2.0.0
  - oauth2: 1.0.5
  - password_policy: 1.2.2
  - provisioning_api: 1.2.0
  - quota_warning: 1.1.1
  - serverinfo: 1.2.0
  - sharebymail: 1.2.0
  - theming: 1.3.0
  - twofactor_backupcodes: 1.1.1
  - updatenotification: 1.2.0
  - user_ldap: 1.2.1
  - workflowengine: 1.2.0
Disabled:
  - encryption
  - federation
  - files_external
  - files_versions
  - firstrunwizard
  - nextcloud_announcements
  - survey_client
  - systemtags
  - user_external

Are you using external storage, if yes which one: -/-

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP

If you need ldap:show-config... just ask, i need to clean it before posting...

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions