Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

user_status "last statuses" widget leaks account names #27122

Closed
doobry-systemli opened this issue May 26, 2021 · 2 comments · Fixed by #29260
Closed

user_status "last statuses" widget leaks account names #27122

doobry-systemli opened this issue May 26, 2021 · 2 comments · Fixed by #29260
Labels
2. developing Work in progress bug security

Comments

@doobry-systemli
Copy link

There should be an option to globally disable the "Last statuses" widget. It leaks account names, which might be the desired behaviour, but might as well be not.

On "semi-public" Nextcloud instances you usually don't want to expose other users to each other, which is also why e.g. shareapi_allow_share_dialog_user_enumeration can be disabled.

Currently it's only possible to disable user_status altogether. It would be nice if there was the option to keep user_status enabled but disable the "Last statuses" widget.
@doobry-systemli doobry-systemli added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug labels May 26, 2021
@mejo-
Copy link
Member

mejo- commented Jul 4, 2021

Oh wow, I just stumbled upon this bug and realized that it's possible to get a full list of users using the user_status api. https://cloud.example.org/ocs/v2.php/apps/user_status/api/v1/statuses will return statuses for all users.

I already looked into a fix, but I'm unsure what's the best approach. We probably should check for the shareapi_allow_share_dialog_user_enumeration config setting in statusService->findAll() and statusService->findAllRecentStatusChanges() and return an empty array if it's disabled.

But to be honest, I'm not sure whether it's a good idea to provide an API endpoint that lists all users at once at all, even without shareapi_allow_share_dialog_user_enumeration disabled, no? Also, I couldn't find usage of the Statuses#findAll route (URL /api/v1/statuses), at least not in the Nextcloud server code. So maybe this route should be removed altogether?

So my suggested fix would be twofold:

  • Remove the route Statuses#findAll and statusService->findAll() altogether
  • Make statusService->findAllRecentStatusChanges return an empty array if config option shareapi_allow_share_dialog_user_enumeration is disabled

Let me know what you think and I could prepare a patch.

mejo- added a commit that referenced this issue Jul 8, 2021
@mejo-
Return empty user status list if user enumeration is disabled (Fixes: #…
cf9f932 
…27122)

The functions to find statuses from other users listed other users even
if with disabled enumeration (`shareapi_allow_share_dialog_user_enumeration`
setting in core app settings).

Now the functions respect `shareapi_allow_share_dialog_user_enumeration`
and return empty lists if it is not set to `yes`.

Fixes: #27122
@mejo- mejo- mentioned this issue Jul 8, 2021
Closed
mejo- added a commit that referenced this issue Jul 8, 2021
@mejo-
Return empty user status list if user enumeration is disabled (Fixes: #…
c0a6312 
…27122)

The functions to find statuses from other users listed other users even
if with disabled enumeration (`shareapi_allow_share_dialog_user_enumeration`
setting in core app settings).

Now the functions respect `shareapi_allow_share_dialog_user_enumeration`
and return empty lists if it is not set to `yes`.

Fixes: #27122
Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 8, 2021
@mejo-
Return empty user status list if user enumeration is disabled (Fixes: #…
c8795e6 
…27122)

The functions to find statuses from other users listed other users even
if with disabled enumeration (`shareapi_allow_share_dialog_user_enumeration`
setting in core app settings).

Now the functions respect `shareapi_allow_share_dialog_user_enumeration`
and return empty lists if it is not set to `yes`.

Fixes: #27122
Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 8, 2021
@mejo-
Return empty user status list if user enumeration is disabled (Fixes: #…
9ded77f 
…27122)

The functions to find statuses from other users listed other users even
if with disabled enumeration (`shareapi_allow_share_dialog_user_enumeration`
setting in core app settings).

Now the functions respect `shareapi_allow_share_dialog_user_enumeration`
and return empty lists if it is not set to `yes`.

Fixes: #27122
Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 8, 2021
@mejo-
Return empty user status list if user enumeration is disabled (Fixes: #…
260b3ed 
…27122)

The functions to find statuses from other users listed other users even
if with disabled enumeration (`shareapi_allow_share_dialog_user_enumeration`
setting in core app settings).

Now the functions respect `shareapi_allow_share_dialog_user_enumeration`
and return empty lists if it is not set to `yes`.

Fixes: #27122
Signed-off-by: Jonas Meurer <[email protected]>
@mejo-
Copy link
Member

mejo- commented Jul 8, 2021

I opened a PR to fix this issue: #27879

mejo- added a commit that referenced this issue Jul 8, 2021
@mejo-
Return empty user status list if user enumeration is disabled (Fixes: #…
8b50919 
…27122)

The functions to find statuses from other users listed other users even
if with disabled enumeration (`shareapi_allow_share_dialog_user_enumeration`
setting in core app settings).

Now the functions respect `shareapi_allow_share_dialog_user_enumeration`
and return empty lists if it is not set to `yes`.

Fixes: #27122
Signed-off-by: Jonas Meurer <[email protected]>
@szaimen szaimen added 2. developing Work in progress and removed 0. Needs triage Pending check for reproducibility or if it fits our roadmap labels Jul 8, 2021
mejo- added a commit that referenced this issue Jul 28, 2021
@mejo-
Respect user enumeration settings in user status lists
393721d 
The functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 28, 2021
@mejo-
Respect user enumeration settings in user status lists
ca826b7 
The functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 28, 2021
@mejo-
Respect user enumeration settings in user status lists
24952d4 
The functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 28, 2021
@mejo-
Respect user enumeration settings in user status lists
6ef3218 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 29, 2021
@mejo-
Respect user enumeration settings in user status lists
55c2716 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 30, 2021
@mejo-
Respect user enumeration settings in user status lists
c964fe0 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 30, 2021
@mejo-
Respect user enumeration settings in user status lists
f048df1 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Jul 30, 2021
@mejo-
Respect user enumeration settings in user status lists
bb3e7e1 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Oct 15, 2021
@mejo-
Respect user enumeration settings in user status lists
80d472d 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Oct 15, 2021
@mejo-
Respect user enumeration settings in user status lists
f5bc265 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Oct 15, 2021
@mejo-
Respect user enumeration settings in user status lists
9d153b9 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
@mejo- mejo- mentioned this issue Oct 15, 2021
Merged
mejo- added a commit that referenced this issue Oct 16, 2021
@mejo-
Respect user enumeration settings in user status lists
ced8e26 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Oct 19, 2021
@mejo-
Respect user enumeration settings in user status lists
7c64e5c 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Oct 20, 2021
@mejo-
Respect user enumeration settings in user status lists
3fe267b 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
mejo- added a commit that referenced this issue Oct 25, 2021
@mejo-
Respect user enumeration settings in user status lists
af00399 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
@mejo- mejo- mentioned this issue Oct 25, 2021
Merged
mejo- added a commit that referenced this issue Oct 25, 2021
@mejo-
Respect user enumeration settings in user status lists
02ce5c8 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
@mejo- mejo- mentioned this issue Oct 25, 2021
Merged
mejo- added a commit that referenced this issue Oct 25, 2021
@mejo-
Respect user enumeration settings in user status lists
50a2574 
So far, the functions to find user statuses listed didn't respect user
enumeration settings (`shareapi_allow_share_dialog_user_enumeration`
and `shareapi_restrict_user_enumeration_to_group` core app settings).

Fix this privacy issue by returning an empty list in case
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

In the long run, we might want to return users from common groups if
`shareapi_restrict_user_enumeration_to_group` is set. It's complicated
to implement this in a way that scales, though. See the discussion at
#27879 (review)
for details.

Also, don't register the user_status dashboard widget at all if
`shareapi_allow_share_dialog_user_enumeration` is unset or
`shareapi_restrict_user_enumeration_to_group` is set.

Fixes: #27122

Signed-off-by: Jonas Meurer <[email protected]>
@mejo- mejo- mentioned this issue Oct 25, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2. developing Work in progress bug security
Projects
None yet
Milestone
No milestone
4 participants
@PVince81 @mejo- @doobry-systemli @szaimen