diff options
| author | John Molakvoæ <skjnldsv@users.noreply.github.com> | 2021-12-20 10:07:55 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-12-20 10:07:55 +0100 |
| commit | b5ae67ac2ab2aa9e3a4794b9cb7b6fe5aaff1e6f (patch) | |
| tree | 5cb938f484142fd0a9a30d8b45fdfe908447b547 /apps/user_ldap | |
| parent | dcc6dfaafa82ff314da9a32ebbf1df9d173c7c0a (diff) | |
| parent | 8266f88755696c7a2a0cc489bb1e501bc34393b0 (diff) | |
| download | nextcloud-server-b5ae67ac2ab2aa9e3a4794b9cb7b6fe5aaff1e6f.tar.gz nextcloud-server-b5ae67ac2ab2aa9e3a4794b9cb7b6fe5aaff1e6f.zip | |
Merge pull request #29329 from nextcloud/fix/noid/groups-unwarranted-members
Diffstat (limited to 'apps/user_ldap')
| -rw-r--r-- | apps/user_ldap/lib/Group_LDAP.php | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/apps/user_ldap/lib/Group_LDAP.php b/apps/user_ldap/lib/Group_LDAP.php index 9172b5fa25f..f757a8b5e12 100644 --- a/apps/user_ldap/lib/Group_LDAP.php +++ b/apps/user_ldap/lib/Group_LDAP.php @@ -248,7 +248,12 @@ class Group_LDAP extends BackendUtility implements GroupInterface, IGroupLDAP, I // but not included in the results laters on $excludeFromResult = $dnGroup; } + // cache only base groups, otherwise groups get additional unwarranted members + $shouldCacheResult = count($seen) === 0; + + static $rawMemberReads = []; // runtime cache for intermediate ldap read results $allMembers = []; + if (array_key_exists($dnGroup, $seen)) { return []; } @@ -290,7 +295,11 @@ class Group_LDAP extends BackendUtility implements GroupInterface, IGroupLDAP, I } $seen[$dnGroup] = 1; - $members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr); + $members = $rawMemberReads[$dnGroup] ?? null; + if ($members === null) { + $members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr); + $rawMemberReads[$dnGroup] = $members; + } if (is_array($members)) { $fetcher = function ($memberDN) use (&$seen) { return $this->_groupMembers($memberDN, $seen); @@ -306,7 +315,10 @@ class Group_LDAP extends BackendUtility implements GroupInterface, IGroupLDAP, I } } - $this->access->connection->writeToCache($cacheKey, $allMembers); + if ($shouldCacheResult) { + $this->access->connection->writeToCache($cacheKey, $allMembers); + unset($rawMemberReads[$dnGroup]); + } if (isset($attemptedLdapMatchingRuleInChain) && $this->access->connection->ldapMatchingRuleInChainState === Configuration::LDAP_SERVER_FEATURE_UNKNOWN && !empty($allMembers) |