Add known user check in avatar when v2-private scope

Signed-off-by: Vincent Petry <vincent@nextcloud.com>

3 files changed, 30 insertions, 13 deletions

diff --git a/lib/private/Avatar/AvatarManager.php b/lib/private/Avatar/AvatarManager.php
index 92cd502dacb..04d3a721022 100644
--- a/lib/private/Avatar/AvatarManager.php
+++ b/lib/private/Avatar/AvatarManager.php
@@ -34,6 +34,7 @@ declare(strict_types=1);
 
 namespace OC\Avatar;
 
+use OC\KnownUser\KnownUserService;
 use OC\User\Manager;
 use OC\User\NoUserException;
 use OCP\Accounts\IAccountManager;
@@ -73,6 +74,9 @@ class AvatarManager implements IAvatarManager {
 	/** @var IAccountManager */
 	private $accountManager;
 
+	/** @var KnownUserService */
+	private $knownUserService;
+
 	/**
 	 * AvatarManager constructor.
 	 *
@@ -90,7 +94,9 @@ class AvatarManager implements IAvatarManager {
 			IL10N $l,
 			ILogger $logger,
 			IConfig $config,
-			IAccountManager $accountManager) {
+			IAccountManager $accountManager,
+			KnownUserService $knownUserService
+	) {
 		$this->userSession = $userSession;
 		$this->userManager = $userManager;
 		$this->appData = $appData;
@@ -98,6 +104,7 @@ class AvatarManager implements IAvatarManager {
 		$this->logger = $logger;
 		$this->config = $config;
 		$this->accountManager = $accountManager;
+		$this->knownUserService = $knownUserService;
 	}
 
 	/**
@@ -128,17 +135,21 @@ class AvatarManager implements IAvatarManager {
 			$folder = $this->appData->newFolder($userId);
 		}
 
-		// requesting in public page
-		if ($requestingUser === null) {
-			$account = $this->accountManager->getAccount($user);
-			$avatarProperties = $account->getProperty(IAccountManager::PROPERTY_AVATAR);
-			$avatarScope = $avatarProperties->getScope();
-
-			// v2-private scope hides the avatar from public access
-			if ($avatarScope === IAccountManager::SCOPE_PRIVATE) {
-				// use a placeholder avatar which caches the generated images
-				return new PlaceholderAvatar($folder, $user, $this->logger);
-			}
+		$account = $this->accountManager->getAccount($user);
+		$avatarProperties = $account->getProperty(IAccountManager::PROPERTY_AVATAR);
+		$avatarScope = $avatarProperties->getScope();
+
+		if (
+			// v2-private scope hides the avatar from public access and from unknown users
+			$avatarScope === IAccountManager::SCOPE_PRIVATE
+			&& (
+				// accessing from public link
+				$requestingUser === null
+				// logged in, but unknown to user
+				|| !$this->knownUserService->isKnownToUser($requestingUser->getUID(), $userId)
+			)) {
+			// use a placeholder avatar which caches the generated images
+			return new PlaceholderAvatar($folder, $user, $this->logger);
 		}
 
 		return new UserAvatar($folder, $this->l, $user, $this->logger, $this->config);
diff --git a/lib/private/KnownUser/KnownUserService.php b/lib/private/KnownUser/KnownUserService.php
index 96af21c836f..1f300a9f8e4 100644
--- a/lib/private/KnownUser/KnownUserService.php
+++ b/lib/private/KnownUser/KnownUserService.php
@@ -74,6 +74,10 @@ class KnownUserService {
 	 * @return bool
 	 */
 	public function isKnownToUser(string $knownTo, string $contactUserId): bool {
+		if ($knownTo === $contactUserId) {
+			return true;
+		}
+
 		if (!isset($this->knownUsers[$knownTo])) {
 			$entities = $this->mapper->getKnownUsers($knownTo);
 			$this->knownUsers[$knownTo] = [];
diff --git a/lib/private/Server.php b/lib/private/Server.php
index 93ad3b38997..26c76125e56 100644
--- a/lib/private/Server.php
+++ b/lib/private/Server.php
@@ -104,6 +104,7 @@ use OC\IntegrityCheck\Checker;
 use OC\IntegrityCheck\Helpers\AppLocator;
 use OC\IntegrityCheck\Helpers\EnvironmentHelper;
 use OC\IntegrityCheck\Helpers\FileAccessHelper;
+use OC\KnownUser\KnownUserService;
 use OC\Lock\DBLockingProvider;
 use OC\Lock\MemcacheLockingProvider;
 use OC\Lock\NoopLockingProvider;
@@ -726,7 +727,8 @@ class Server extends ServerContainer implements IServerContainer {
 				$c->getL10N('lib'),
 				$c->get(ILogger::class),
 				$c->get(\OCP\IConfig::class),
-				$c->get(IAccountManager::class)
+				$c->get(IAccountManager::class),
+				$c->get(KnownUserService::class)
 			);
 		});
 		$this->registerAlias(IAvatarManager::class, AvatarManager::class);