fix: Exclude non accepted shares when computing access list

Signed-off-by: Louis Chemineau <[email protected]> [skip ci]
nextcloud · Jan 30, 2025 · b773a56 · b773a56
1 parent 1143f8b
commit b773a56
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 1 deletion.
diff --git a/3rdparty b/3rdparty
diff --git a/lib/private/Share20/DefaultShareProvider.php b/lib/private/Share20/DefaultShareProvider.php
@@ -1338,6 +1338,19 @@ public function getAccessList($nodes, $currentAccess) {
 				$qb->expr()->eq('item_type', $qb->createNamedParameter('file')),
 				$qb->expr()->eq('item_type', $qb->createNamedParameter('folder'))
 			));
+
+		// Ensure accepted is true for user and usergroup type
+		$qb->andWhere(
+			$qb->expr()->orX(
+				$qb->expr()->andX(
+					$qb->expr()->neq('share_type', $qb->createNamedParameter(IShare::TYPE_USER)),
+					$qb->expr()->neq('share_type', $qb->createNamedParameter(IShare::TYPE_USERGROUP)),
+				),
+				$qb->expr()->eq('accepted', $qb->createNamedParameter(IShare::STATUS_ACCEPTED, IQueryBuilder::PARAM_INT)),
+			),
+		);
+
+
 		$cursor = $qb->execute();
 
 		$users = [];

diff --git a/tests/lib/Share20/DefaultShareProviderTest.php b/tests/lib/Share20/DefaultShareProviderTest.php
@@ -2701,6 +2701,7 @@ public function testGetAccessListNoCurrentAccessRequired() {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_ALL);
 		$share1 = $this->provider->create($share1);
+		$share1 = $provider->acceptShare($share1, $u2->getUid());
 
 		$share2 = $shareManager->newShare();
 		$share2->setNode($folder2)
@@ -2713,6 +2714,9 @@ public function testGetAccessListNoCurrentAccessRequired() {
 
 		$shareManager->deleteFromSelf($share2, $u4->getUID());
 
+		$share2 = $provider->acceptShare($share2, $u3->getUid());
+		$share2 = $provider->acceptShare($share2, $u4->getUid());
+
 		$share3 = $shareManager->newShare();
 		$share3->setNode($file1)
 			->setSharedBy($u3->getUID())
@@ -2729,6 +2733,7 @@ public function testGetAccessListNoCurrentAccessRequired() {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_READ);
 		$share4 = $this->provider->create($share4);
+		$share4 = $provider->acceptShare($share4, $u5->getUid());
 
 		$result = $provider->getAccessList([$folder1, $folder2, $file1], false);
 
@@ -2799,6 +2804,7 @@ public function testGetAccessListCurrentAccessRequired() {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_ALL);
 		$share1 = $this->provider->create($share1);
+		$share1 = $provider->acceptShare($share1, $u2->getUid());
 
 		$share2 = $shareManager->newShare();
 		$share2->setNode($folder2)
@@ -2808,6 +2814,8 @@ public function testGetAccessListCurrentAccessRequired() {
 			->setShareType(IShare::TYPE_GROUP)
 			->setPermissions(\OCP\Constants::PERMISSION_ALL);
 		$share2 = $this->provider->create($share2);
+		$share2 = $provider->acceptShare($share2, $u3->getUid());
+		$share2 = $provider->acceptShare($share2, $u4->getUid());
 
 		$shareManager->deleteFromSelf($share2, $u4->getUID());
 
@@ -2827,6 +2835,7 @@ public function testGetAccessListCurrentAccessRequired() {
 			->setShareType(IShare::TYPE_USER)
 			->setPermissions(\OCP\Constants::PERMISSION_READ);
 		$share4 = $this->provider->create($share4);
+		$share4 = $provider->acceptShare($share4, $u5->getUid());
 
 		$result = $provider->getAccessList([$folder1, $folder2, $file1], true);