diff options
| author | Georg Ehrke <developer@georgehrke.com> | 2020-09-10 12:55:41 +0200 |
|---|---|---|
| committer | backportbot[bot] <backportbot[bot]@users.noreply.github.com> | 2020-09-14 06:20:32 +0000 |
| commit | ac87e46dff30c81be1b0f6398012f193ce4988db (patch) | |
| tree | 1983f46e348a4283bb7b42e65fbf4efa8b2469ed /apps/dav | |
| parent | 9e88559e94f7c5c049f1eb156dbe387355c743aa (diff) | |
| download | nextcloud-server-ac87e46dff30c81be1b0f6398012f193ce4988db.tar.gz nextcloud-server-ac87e46dff30c81be1b0f6398012f193ce4988db.zip | |
Mitigate encoding issue with user principal uri
Signed-off-by: Georg Ehrke <developer@georgehrke.com>
Diffstat (limited to 'apps/dav')
| -rw-r--r-- | apps/dav/lib/Connector/Sabre/Principal.php | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/apps/dav/lib/Connector/Sabre/Principal.php b/apps/dav/lib/Connector/Sabre/Principal.php index cfe9a6d7f73..1ddbc1a6083 100644 --- a/apps/dav/lib/Connector/Sabre/Principal.php +++ b/apps/dav/lib/Connector/Sabre/Principal.php @@ -168,7 +168,11 @@ class Principal implements BackendInterface { } if ($prefix === $this->principalPrefix) { - $user = $this->userManager->get($name); + // Depending on where it is called, it may happen that this function + // is called either with a urlencoded version of the name or with a non-urlencoded one. + // The urldecode function replaces %## and +, both of which are forbidden in usernames. + // Hence there can be no ambiguity here and it is safe to call urldecode on all usernames + $user = $this->userManager->get(urldecode($name)); if ($user !== null) { return $this->userToPrincipal($user); |