Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release-10.2.1] Return "password fields" only if public-link password is set. #35541 #35563

Merged
merged 1 commit into from
Jun 18, 2019
Merged

[release-10.2.1] Return "password fields" only if public-link password is set. #35541 #35563

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions apps/files_sharing/lib/Controller/Share20OcsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,8 +201,12 @@ protected function formatShare(IShare $share, $received = false) {
$result['share_with'] = $share->getSharedWith();
$result['share_with_displayname'] = $group !== null ? $group->getDisplayName() : $share->getSharedWith();
} elseif ($share->getShareType() === Share::SHARE_TYPE_LINK) {
$result['share_with'] = '***redacted***';
$result['share_with_displayname'] = '***redacted***';
if ($share->getPassword() !== null) {
// Misleading names ahead!: This fields are miss-used to
// read/write public link password-hashes
$result['share_with'] = '***redacted***';
$result['share_with_displayname'] = '***redacted***';
}
$result['name'] = $share->getName();

$result['token'] = $share->getToken();
Expand Down
24 changes: 24 additions & 0 deletions tests/acceptance/features/apiShareManagementBasic/createShare.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,7 @@ Feature: sharing
Given using OCS API version "<ocs_api_version>"
When user "user0" creates a public link share using the sharing API with settings
| path | welcome.txt |
| password | %public% |
Then the OCS status code should be "<ocs_status_code>"
And the HTTP status code should be "200"
And the fields of the last response should include
Expand All @@ -208,6 +209,29 @@ Feature: sharing
| 1 | 100 |
| 2 | 200 |

@public_link_share-feature-required
Scenario Outline: Getting the share information of passwordless public-links hides credential placeholders
Given using OCS API version "<ocs_api_version>"
When user "user0" creates a public link share using the sharing API with settings
| path | welcome.txt |
Then the OCS status code should be "<ocs_status_code>"
And the HTTP status code should be "200"
And the fields of the last response should include
| file_target | /welcome.txt |
| path | /welcome.txt |
| item_type | file |
| share_type | 3 |
| permissions | 1 |
| uid_owner | user0 |
And the fields of the last response should not include
| share_with | ***redacted*** |
| share_with_displayname | ***redacted*** |

Examples:
| ocs_api_version | ocs_status_code |
| 1 | 100 |
| 2 | 200 |

Scenario Outline: Creating a new share with a disabled user
Given using OCS API version "<ocs_api_version>"
And user "user1" has been created with default attributes and without skeleton files
Expand Down
22 changes: 22 additions & 0 deletions tests/acceptance/features/bootstrap/Sharing.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1371,6 +1371,28 @@ public function checkFields($body) {
}
}

/**
* @Then the fields of the last response should not include
*
* @param TableNode|null $body
*
* @return void
*/
public function checkFieldsNotInResponse($body) {
if ($body instanceof TableNode) {
$fd = $body->getRowsHash();

foreach ($fd as $field => $value) {
$value = $this->replaceValuesFromTable($field, $value);
if ($this->isFieldInResponse($field, $value)) {
PHPUnit\Framework\Assert::fail(
"$field has value $value"
);
}
}
}
}

/**
* @When user :user removes all shares from the file named :fileName using the sharing API
* @Given user :user has removed all shares from the file named :fileName
Expand Down