diff options
| author | Vincent Petry <vincent@nextcloud.com> | 2023-01-11 15:34:07 +0100 |
|---|---|---|
| committer | Vincent Petry <vincent@nextcloud.com> | 2023-01-13 10:31:19 +0100 |
| commit | c24884d014cb705b64b45af1a41a8b8cc5669121 (patch) | |
| tree | 6fb80d7daac2d923d3fbb8ff5940abe5af288f91 /apps/provisioning_api/lib/Controller | |
| parent | b88864b89967cabd78c47d75ee2ff4b1d204934f (diff) | |
| download | nextcloud-server-c24884d014cb705b64b45af1a41a8b8cc5669121.tar.gz nextcloud-server-c24884d014cb705b64b45af1a41a8b8cc5669121.zip | |
Only expose storage location to admins
Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
Diffstat (limited to 'apps/provisioning_api/lib/Controller')
| -rw-r--r-- | apps/provisioning_api/lib/Controller/AUserData.php | 21 |
1 files changed, 12 insertions, 9 deletions
diff --git a/apps/provisioning_api/lib/Controller/AUserData.php b/apps/provisioning_api/lib/Controller/AUserData.php index 668b86c059a..b4df2431adb 100644 --- a/apps/provisioning_api/lib/Controller/AUserData.php +++ b/apps/provisioning_api/lib/Controller/AUserData.php @@ -104,6 +104,7 @@ abstract class AUserData extends OCSController { */ protected function getUserData(string $userId, bool $includeScopes = false): array { $currentLoggedInUser = $this->userSession->getUser(); + assert($currentLoggedInUser !== null, 'No user logged in'); $data = []; @@ -113,8 +114,8 @@ abstract class AUserData extends OCSController { throw new OCSNotFoundException('User does not exist'); } - // Should be at least Admin Or SubAdmin! - if ($this->groupManager->isAdmin($currentLoggedInUser->getUID()) + $isAdmin = $this->groupManager->isAdmin($currentLoggedInUser->getUID()); + if ($isAdmin || $this->groupManager->getSubAdmin()->isUserAccessible($currentLoggedInUser, $targetUserObject)) { $data['enabled'] = $this->config->getUserValue($targetUserObject->getUID(), 'core', 'enabled', 'true') === 'true'; } else { @@ -132,13 +133,15 @@ abstract class AUserData extends OCSController { $gids[] = $group->getGID(); } - try { - # might be thrown by LDAP due to handling of users disappears - # from the external source (reasons unknown to us) - # cf. https://github.com/nextcloud/server/issues/12991 - $data['storageLocation'] = $targetUserObject->getHome(); - } catch (NoUserException $e) { - throw new OCSNotFoundException($e->getMessage(), $e); + if ($isAdmin) { + try { + # might be thrown by LDAP due to handling of users disappears + # from the external source (reasons unknown to us) + # cf. https://github.com/nextcloud/server/issues/12991 + $data['storageLocation'] = $targetUserObject->getHome(); + } catch (NoUserException $e) { + throw new OCSNotFoundException($e->getMessage(), $e); + } } // Find the data |