diff options
| author | Vincent Petry <vincent@nextcloud.com> | 2023-01-11 15:34:07 +0100 |
|---|---|---|
| committer | Vincent Petry <vincent@nextcloud.com> | 2023-01-13 10:31:19 +0100 |
| commit | c24884d014cb705b64b45af1a41a8b8cc5669121 (patch) | |
| tree | 6fb80d7daac2d923d3fbb8ff5940abe5af288f91 /apps/provisioning_api | |
| parent | b88864b89967cabd78c47d75ee2ff4b1d204934f (diff) | |
| download | nextcloud-server-c24884d014cb705b64b45af1a41a8b8cc5669121.tar.gz nextcloud-server-c24884d014cb705b64b45af1a41a8b8cc5669121.zip | |
Only expose storage location to admins
Co-authored-by: Côme Chilliet <91878298+come-nc@users.noreply.github.com>
Signed-off-by: Vincent Petry <vincent@nextcloud.com>
Diffstat (limited to 'apps/provisioning_api')
| -rw-r--r-- | apps/provisioning_api/lib/Controller/AUserData.php | 21 | ||||
| -rw-r--r-- | apps/provisioning_api/tests/Controller/UsersControllerTest.php | 12 |
2 files changed, 16 insertions, 17 deletions
diff --git a/apps/provisioning_api/lib/Controller/AUserData.php b/apps/provisioning_api/lib/Controller/AUserData.php index 668b86c059a..b4df2431adb 100644 --- a/apps/provisioning_api/lib/Controller/AUserData.php +++ b/apps/provisioning_api/lib/Controller/AUserData.php @@ -104,6 +104,7 @@ abstract class AUserData extends OCSController { */ protected function getUserData(string $userId, bool $includeScopes = false): array { $currentLoggedInUser = $this->userSession->getUser(); + assert($currentLoggedInUser !== null, 'No user logged in'); $data = []; @@ -113,8 +114,8 @@ abstract class AUserData extends OCSController { throw new OCSNotFoundException('User does not exist'); } - // Should be at least Admin Or SubAdmin! - if ($this->groupManager->isAdmin($currentLoggedInUser->getUID()) + $isAdmin = $this->groupManager->isAdmin($currentLoggedInUser->getUID()); + if ($isAdmin || $this->groupManager->getSubAdmin()->isUserAccessible($currentLoggedInUser, $targetUserObject)) { $data['enabled'] = $this->config->getUserValue($targetUserObject->getUID(), 'core', 'enabled', 'true') === 'true'; } else { @@ -132,13 +133,15 @@ abstract class AUserData extends OCSController { $gids[] = $group->getGID(); } - try { - # might be thrown by LDAP due to handling of users disappears - # from the external source (reasons unknown to us) - # cf. https://github.com/nextcloud/server/issues/12991 - $data['storageLocation'] = $targetUserObject->getHome(); - } catch (NoUserException $e) { - throw new OCSNotFoundException($e->getMessage(), $e); + if ($isAdmin) { + try { + # might be thrown by LDAP due to handling of users disappears + # from the external source (reasons unknown to us) + # cf. https://github.com/nextcloud/server/issues/12991 + $data['storageLocation'] = $targetUserObject->getHome(); + } catch (NoUserException $e) { + throw new OCSNotFoundException($e->getMessage(), $e); + } } // Find the data diff --git a/apps/provisioning_api/tests/Controller/UsersControllerTest.php b/apps/provisioning_api/tests/Controller/UsersControllerTest.php index d0e808c990f..e5c5678efd3 100644 --- a/apps/provisioning_api/tests/Controller/UsersControllerTest.php +++ b/apps/provisioning_api/tests/Controller/UsersControllerTest.php @@ -1165,9 +1165,8 @@ class UsersControllerTest extends TestCase { ->method('getDisplayName') ->willReturn('Demo User'); $targetUser - ->expects($this->once()) - ->method('getHome') - ->willReturn('/var/www/newtcloud/data/UID'); + ->expects($this->never()) + ->method('getHome'); $targetUser ->expects($this->once()) ->method('getLastLogin') @@ -1206,7 +1205,6 @@ class UsersControllerTest extends TestCase { $expected = [ 'id' => 'UID', 'enabled' => true, - 'storageLocation' => '/var/www/newtcloud/data/UID', 'lastLogin' => 1521191471000, 'backend' => 'Database', 'subadmin' => [], @@ -1349,9 +1347,8 @@ class UsersControllerTest extends TestCase { ->method('getUID') ->willReturn('UID'); $targetUser - ->expects($this->once()) - ->method('getHome') - ->willReturn('/var/www/newtcloud/data/UID'); + ->expects($this->never()) + ->method('getHome'); $targetUser ->expects($this->once()) ->method('getLastLogin') @@ -1385,7 +1382,6 @@ class UsersControllerTest extends TestCase { $expected = [ 'id' => 'UID', - 'storageLocation' => '/var/www/newtcloud/data/UID', 'lastLogin' => 1521191471000, 'backend' => 'Database', 'subadmin' => [], |