fix(UserPlugin): Don't return disabled users on user ID and mail match

Assisted-by: ClaudeCode:claude-fable-5
Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>

Author: DerDreschner

build/integration/sharees_features/sharees.feature

@@ -51,6 +51,24 @@ Feature: sharees
     And "exact remotes" sharees returned is empty
     And "remotes" sharees returned is empty
 
+  Scenario: Search without exact match does not return disabled users
+    Given As an "admin"
+    And assure user "Sharee1" is disabled
+    And As an "test"
+    When getting sharees for
+      | search | Sharee |
+      | itemType | file |
+    Then the OCS status code should be "100"
+    And the HTTP status code should be "200"
+    And "exact users" sharees returned is empty
+    And "users" sharees returned are
+      | Sharee2 | 0 | Sharee2 | sharee2@system.com |
+    And "exact groups" sharees returned is empty
+    And "groups" sharees returned are
+      | ShareeGroup | 1 | ShareeGroup |
+    And "exact remotes" sharees returned is empty
+    And "remotes" sharees returned is empty
+
   Scenario: Search only with group members - denied
     Given As an "test"
     And parameter "shareapi_only_share_with_group_members" of app "core" is set to "yes"
@@ -254,6 +272,22 @@ Feature: sharees
     Then "exact remotes" sharees returned is empty
     Then "remotes" sharees returned is empty
 
+  Scenario: Search with exact match does not return disabled users
+    Given As an "admin"
+    And assure user "Sharee1" is disabled
+    And As an "test"
+    When getting sharees for
+      | search | Sharee1 |
+      | itemType | file |
+    Then the OCS status code should be "100"
+    And the HTTP status code should be "200"
+    And "exact users" sharees returned is empty
+    And "users" sharees returned is empty
+    And "exact groups" sharees returned is empty
+    And "groups" sharees returned is empty
+    And "exact remotes" sharees returned is empty
+    And "remotes" sharees returned is empty
+
   Scenario: Search with exact match not-exact casing
     Given As an "test"
     When getting sharees for
@@ -364,6 +398,21 @@ Feature: sharees
     And "exact emails" sharees returned is empty
     And "emails" sharees returned is empty
 
+  Scenario: Search user by system e-mail address does not return disabled users
+    Given As an "admin"
+    And assure user "Sharee2" is disabled
+    And As an "test"
+    When getting sharees for
+      | search    | sharee2@system.com |
+      | itemType  | file |
+      | shareType | 0 |
+    Then the OCS status code should be "100"
+    And the HTTP status code should be "200"
+    And "exact users" sharees returned is empty
+    And "users" sharees returned is empty
+    And "exact emails" sharees returned is empty
+    And "emails" sharees returned is empty
+
   Scenario: Search user by system e-mail address without exact match
     Given As an "test"
     When getting sharees for

lib/private/Collaboration/Collaborators/UserPlugin.php

@@ -102,7 +102,7 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b
 				// User backends may also resolve email addresses or other login names here
 				// (e.g. for login via email). Only an actual user id match counts as user id
 				// full match, everything else is governed by the email setting below.
-				if ($user !== null && mb_strtolower($user->getUID()) === $lowerSearch) {
+				if ($user !== null && $user->isEnabled() && mb_strtolower($user->getUID()) === $lowerSearch) {
 					$users[$user->getUID()] = ['exact', $user];
 				}
 			}
@@ -119,7 +119,10 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b
 					$uid = $row['uid'];
 					$email = $row['value'];
 					$isAdditional = $row['name'] === 'additional_mail';
-					$users[$uid] = ['exact', $this->userManager->get($uid), $isAdditional ? $email : null];
+					$user = $this->userManager->get($uid);
+					if ($user !== null && $user->isEnabled()) {
+						$users[$uid] = ['exact', $user, $isAdditional ? $email : null];
+					}
 				}
 				$result->closeCursor();
 			}