Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add option to disable user autocomplementation #152

Closed
xshadow opened this issue Nov 16, 2017 · 0 comments · Fixed by #299
Closed

Add option to disable user autocomplementation #152

xshadow opened this issue Nov 16, 2017 · 0 comments · Fixed by #299

Comments

@xshadow
Copy link

xshadow commented Nov 16, 2017

The Circles App does not honour the "Allow username autocomplementation in share dialog ..." setting!

If Circles is enabled and you add a new circle and click on "add a member" it will propose usernames to you. That could leak user information of other users.

It would be great to add an option to disable this autocomplementation feature, like the opt-out autocomplementation option for the sharing dialog
@xshadow xshadow mentioned this issue Nov 17, 2017
Closed
4 tasks
immerda pushed a commit to immerda/circles that referenced this issue May 6, 2019
honor user enumeration prevention of the share api
ba0a618 
If user enumeration is disabled in nextcloud core, then circle can
be used to circumvent this measure. For example the adduser button
in the user facing circle UI allows enumeration of all registered
users.

This patch honors the choice made in
 'shareapi_allow_share_dialog_user_enumeration'
for deciding if auto completion should present partial results.
This is in line with other apps, such as webdav, which reuse this
configuration choice to disable user enumeration.

In case this preference is set, all partial results are removed
from the results.

Fixes nextcloud#152
@immerda immerda mentioned this issue May 6, 2019
Merged
backportbot-nextcloud bot pushed a commit that referenced this issue Jun 24, 2019
honor user enumeration prevention of the share api
500d1e9 
If user enumeration is disabled in nextcloud core, then circle can
be used to circumvent this measure. For example the adduser button
in the user facing circle UI allows enumeration of all registered
users.

This patch honors the choice made in
 'shareapi_allow_share_dialog_user_enumeration'
for deciding if auto completion should present partial results.
This is in line with other apps, such as webdav, which reuse this
configuration choice to disable user enumeration.

In case this preference is set, all partial results are removed
from the results.

Fixes #152
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

honor user enumeration prevention of the share api immerda/circles
1 participant
@xshadow