Security problem / sharing options

[MathiasPhilipp]

I'm not a developer and absolutely new here. I'm admin and user, never worked with github. Sorry if I do anything wrong or at the wrong place.

In my opinion, the following seems to be a security problem:

Combining the options
"Restrict users to share only with users in their group"
and
"Allow username autocompletion in share dialog." If this is disabled
the full username or email address needs to be entered "

If I enter the username with autocomplete when sharing, all hits for all users over all groups are displayed. Also the users of groups with whom I may not allowed to share. With it I can find out all users (with email) about all groups.

I would expect autocomplete to show me only the users I'm allowed to share.

Is this a security bug or how can I prevent it?

Steps to reproduce

1. enable "Restrict users to share only with users in their group"
2. enable "Allow username autocompletion in share dialog..."
3. share

Expected behaviour

I would expect autocomplete to show me only the users I'm allowed to share.

Actual behaviour

all hits for all users over all groups are displayed. Also the users of groups with whom I may not allowed to share.

Server configuration

Operating system: ? web-hosting

Web server: ?? web-hosting

Database: MYSQL 5.7.20

PHP version: 7.2.1

Nextcloud version: 12.0.4

Updated from an older Nextcloud/ownCloud or fresh install: Updeted from Nextcloud

Where did you install Nextcloud from: web-hosting

Signing status:

Signing status

Login as admin user into your Nextcloud and access 
http://example.com/index.php/settings/integrity/failed 
paste the results here.

List of activated apps:

App list

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nextcloud configuration:

Config report

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

or 

Insert your config.php content here. 
Make sure to remove all sensitive content such as passwords. (e.g. database password, passwordsalt, secret, smtp password, …)

Are you using external storage, if yes which one: local/smb/sftp/...

Are you using encryption: yes/no

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...

LDAP configuration (delete this part if not used)

LDAP config

With access to your command line run e.g.:
sudo -u www-data php occ ldap:show-config
from within your Nextcloud installation folder

Without access to your command line download the data/owncloud.db to your local
computer or access your SQL server remotely and run the select query:
SELECT * FROM `oc_appconfig` WHERE `appid` = 'user_ldap';


Eventually replace sensitive data as the name/IP-address of your LDAP server or groups.

Client configuration

Browser:

Operating system:

Logs

Web server error log

Web server error log

Insert your webserver log here

Nextcloud log (data/nextcloud.log)

Nextcloud log

Insert your Nextcloud log here

Browser log

Browser log

Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

[tflidd]

It was already part of this request (if I don't misread it: #5107) which was set to the Nextcloud 13 milestone. The discussion was more related about the contacts menu.

this point in #5107 seems still to be an issue:

If sharing is restricted to users own groups, he should only see contacts from his groups:

@LEDfan did your implementation (PR #5585) only consider the contacts menu but not the sharing menu?

I can reproduce this problem in NC 13 beta 3.

[tflidd]

is this the same?
#6530

[MathiasPhilipp]

I am not sure: In issue # 8028 you can avoid the problem by disabling "autocomplition" <#6530> #6530 seems to have nothing to do with "autocomplition". I updated today from 12.0.4. to 12.0.5. #8028 seems to be fixed. I’ll check systematically Mit freundlichen Grüßen Mathias Philipp Von: tflidd [mailto:[email protected]] Gesendet: Samstag, 27. Januar 2018 22:33 An: nextcloud/server Cc: MathiasPhilipp; Author Betreff: Re: [nextcloud/server] Security problem / sharing options (#8028) is this the same? <#6530> #6530 — You are receiving this because you authored the thread. Reply to this email directly, <#8028 (comment)> view it on GitHub, or <https://github.com/notifications/unsubscribe-auth/AiHTjf6boj94Ov_ZyiN87DEXB7v7-PZvks5tO5YegaJpZM4RrXUS> mute the thread.https://github.com/notifications/beacon/AiHTjUTcBdfTtDp91g0L3Ua5A1Of_Vq1ks5tO5YegaJpZM4RrXUS.gif

[MathiasPhilipp]

Yes 5107 corresponds to #8028. After update 12.0.4. to 12.0.5. the sharing problem is already solved. I can’t reproduce the security problem. From my point of view it’s fixed. Mit freundlichen Grüßen Mathias Philipp Von: tflidd [mailto:[email protected]] Gesendet: Samstag, 27. Januar 2018 22:26 An: nextcloud/server Cc: MathiasPhilipp; Author Betreff: Re: [nextcloud/server] Security problem / sharing options (#8028) It was already part of this request (if I don't misread it: #5107 <#5107> ) which was set to the Nextcloud 13 milestone. The discussion was more related about the contacts menu. this point in #5107 <#5107> seems still to be an issue: If sharing is restricted to users own groups, he should only see contacts from his groups: @LEDfan <https://github.com/ledfan> did your implementation (PR #5585 <#5585> ) only consider the contacts menu but not the sharing menu? I can reproduce this problem in NC 13 beta 3. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#8028 (comment)> , or mute the thread <https://github.com/notifications/unsubscribe-auth/AiHTjcw6oo3qVway99e5JgG57Kh7rvPNks5tO5R4gaJpZM4RrXUS> .https://github.com/notifications/beacon/AiHTjcuiwS30jOcen1kkO5SkDC0866LMks5tO5R4gaJpZM4RrXUS.gif

[tflidd]

After update 12.0.4. to 12.0.5. the sharing problem is already solved. I can’t reproduce the security problem. From my point of view it’s fixed.

Except that it is broken for NC 13 RC 3 again....

[LEDfan]

After update 12.0.4. to 12.0.5. the sharing problem is already solved.

This bug is the same as in #7428 and #6530 which is fixed in 12.0.5.

I can reproduce this problem in NC 13 beta 3.

The fix was merged into beta 4, I just tested on stable13 and there it's still fixed.