Merge pull request #62097 from nextcloud/backport/61982/stable33

[stable33] fix(UserPlugin): Don't search for displayname when restricted

Author: AndyScherzinger

build/integration/features/bootstrap/ShareesContext.php

@@ -26,6 +26,7 @@ protected function resetAppConfigs() {
 		$this->deleteServerConfig('core', 'shareapi_only_share_with_group_members');
 		$this->deleteServerConfig('core', 'shareapi_only_share_with_group_members_exclude_group_list');
 		$this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match');
+		$this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_displayname');
 		$this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_email');
 		$this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_dn');
 		$this->deleteServerConfig('core', 'shareapi_restrict_user_enumeration_full_match_user_id');

build/integration/sharees_features/sharees_user.feature

@@ -394,6 +394,40 @@ Feature: sharees_user
 			| Test One (Second displayname for user 1) | 0 | test1 | test1 |
 		And "users" sharees returned is empty
 
+	Scenario: Search for displayname returns nothing without sharee enumeration and without full match displayname enumeration
+		Given user "test" with displayname "foo" exists
+		And user "test1" with displayname "Test One" exists
+		And user "test2" with displayname "Test Two" exists
+		And group "groupA" exists
+		And user "test" belongs to group "groupA"
+		And user "test1" belongs to group "groupA"
+		And user "test2" belongs to group "groupA"
+		And As an "test"
+		And parameter "shareapi_allow_share_dialog_user_enumeration" of app "core" is set to "no"
+		And parameter "shareapi_restrict_user_enumeration_full_match_displayname" of app "core" is set to "no"
+		When getting sharees for
+			| search   | Test One |
+			| itemType | file     |
+		Then the OCS status code should be "100"
+		And the HTTP status code should be "200"
+		And "exact users" sharees returned is empty
+		And "users" sharees returned is empty
+
+	Scenario: Search for exact userid returns exact user without sharee enumeration and without full match displayname enumeration
+		Given user "test" with displayname "foo" exists
+		And user "test1" with displayname "Test One" exists
+		And As an "test"
+		And parameter "shareapi_allow_share_dialog_user_enumeration" of app "core" is set to "no"
+		And parameter "shareapi_restrict_user_enumeration_full_match_displayname" of app "core" is set to "no"
+		When getting sharees for
+			| search   | test1 |
+			| itemType | file  |
+		Then the OCS status code should be "100"
+		And the HTTP status code should be "200"
+		And "exact users" sharees returned are
+			| Test One | 0 | test1 | test1 |
+		And "users" sharees returned is empty
+
 	Scenario: Search for exact userid with shared group returns exact user with sharee enumeration limited to group
 		Given user "test" with displayname "foo" exists
 		And user "test1" exists

lib/private/Collaboration/Collaborators/UserPlugin.php

@@ -84,16 +84,19 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b
 		$shareeEnumerationFullMatch = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match', 'yes') === 'yes';
 		if ($shareeEnumerationFullMatch && $search !== '') {
 			$shareeEnumerationFullMatchUserId = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_user_id', 'yes') === 'yes';
+			$shareeEnumerationFullMatchDisplayName = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_displayname', 'yes') === 'yes';
 			$shareeEnumerationFullMatchEmail = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_email', 'yes') === 'yes';
 			$shareeEnumerationFullMatchIgnoreSecondDisplayName = $this->appConfig->getValueString('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_dn', 'no') === 'yes';
 
 			$lowerSearch = mb_strtolower($search);
 
-			// Re-use the results from earlier if possible
-			$usersByDisplayName ??= $this->userManager->searchDisplayName($search, $limit, $offset);
-			foreach ($usersByDisplayName as $user) {
-				if ($user->isEnabled() && (mb_strtolower($user->getDisplayName()) === $lowerSearch || ($shareeEnumerationFullMatchIgnoreSecondDisplayName && trim(mb_strtolower(preg_replace('/ \(.*\)$/', '', $user->getDisplayName()))) === $lowerSearch))) {
-					$users[$user->getUID()] = ['exact', $user];
+			if ($shareeEnumerationFullMatchDisplayName) {
+				// Re-use the results from earlier if possible
+				$usersByDisplayName ??= $this->userManager->searchDisplayName($search, $limit, $offset);
+				foreach ($usersByDisplayName as $user) {
+					if ($user->isEnabled() && (mb_strtolower($user->getDisplayName()) === $lowerSearch || ($shareeEnumerationFullMatchIgnoreSecondDisplayName && trim(mb_strtolower(preg_replace('/ \(.*\)$/', '', $user->getDisplayName()))) === $lowerSearch))) {
+						$users[$user->getUID()] = ['exact', $user];
+					}
 				}
 			}