wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #21553 from owncloud/gwdg-master

Browse source 
Respect user enumeration
This commit is contained in:
Thomas Müller 2016-01-08 18:21:15 +01:00
commit 977e104cd4
1 changed files with 19 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
apps/user_ldap/lib/access.php
View file

@ -1193,7 +1193,7 @@ class Access extends LDAPUtility implements user\IUserTools {
$searchWords = explode(' ', trim($search));
$wordFilters = array();
foreach($searchWords as $word) {
$word .= '*';
$word = $this->prepareSearchTerm($word);
//every word needs to appear at least once
$wordMatchOneAttrFilters = array();
foreach($searchAttributes as $attr) {
@ -1226,7 +1226,8 @@ class Access extends LDAPUtility implements user\IUserTools {
);
}
}
$search = empty($search) ? '*' : $search.'*';
$search = $this->prepareSearchTerm($search);
if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
if(empty($fallbackAttribute)) {
return '';
@ -1243,6 +1244,22 @@ class Access extends LDAPUtility implements user\IUserTools {
return $this->combineFilterWithOr($filter);
}
/**
* returns the search term depending on whether we are allowed
* list users found by ldap with the current input appended by
* a *
* @return string
*/
private function prepareSearchTerm($term) {
$config = \OC::$server->getConfig();
$allowEnum = $config->getAppValue('core', 'shareapi_allow_share_dialog_user_enumeration', 'yes');
$result = empty($term) ? '*' :
$allowEnum !== 'no' ? $term . '*' : $term;
return $result;
}
/**
* returns the filter used for counting users
* @return string