Skip to content

[stable30] fix(sharing): properly frame block list #63930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
susnux merged 3 commits into from
Sep 15, 2026
Merged

[stable30] fix(sharing): properly frame block list #63930

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1dbd3a8
fix(sharing): properly frame block list
susnux Aug 29, 2026
26167b6
chore: compile assets
susnux Sep 15, 2026
2184edc
test(integration): reset share exclude group configs between scenarios
susnux Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions apps/settings/src/components/AdminSettingsSharingForm.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,14 +73,14 @@
value="yes"
type="radio"
@update:checked="onUpdateExcludeGroups">
{{ t('settings', 'Exclude some groups from sharing') }}
{{ t('settings', 'Exclude some groups (block list)') }}
</NcCheckboxRadioSwitch>
<NcCheckboxRadioSwitch :checked.sync="settings.excludeGroups"
name="excludeGroups"
value="allow"
type="radio"
@update:checked="onUpdateExcludeGroups">
{{ t('settings', 'Limit sharing to some groups') }}
{{ t('settings', 'Allow some groups only (allow list)') }}
</NcCheckboxRadioSwitch>
<div v-show="settings.excludeGroups !== 'no'" class="sharing__labeled-entry sharing__input">
<NcSettingsSelectGroup id="settings-sharing-excluded-groups"
Expand All @@ -89,7 +89,15 @@
:label="settings.excludeGroups === 'allow' ? t('settings', 'Groups allowed to share') : t('settings', 'Groups excluded from sharing')"
:disabled="settings.excludeGroups === 'no'"
style="width: 100%" />
<em id="settings-sharing-excluded-groups-desc">{{ t('settings', 'Not allowed groups will still be able to receive shares, but not to initiate them.') }}</em>
<em id="settings-sharing-excluded-groups-desc">
<template v-if="settings.excludeGroups === 'allow'">
{{ t('settings', 'Only members of at least one of these groups will be able to initiate shares.') }}
{{ t('settings', 'Others will be blocked, but are still able to receive shares.') }}
</template>
<template v-else>
{{ t('settings', 'A member of at least one of these groups will not be able to initiate new shares, but will still be able to receive shares.') }}
</template>
</em>
</div>
</div>

Expand Down
2 changes: 2 additions & 0 deletions build/integration/features/bootstrap/FeatureContext.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,5 +25,7 @@ protected function resetAppConfigs(): void {
$this->deleteServerConfig('bruteForce', 'whitelist_0');
$this->deleteServerConfig('bruteForce', 'whitelist_1');
$this->deleteServerConfig('bruteforcesettings', 'apply_allowlist_to_ratelimit');
$this->deleteServerConfig('core', 'shareapi_exclude_groups');
$this->deleteServerConfig('core', 'shareapi_exclude_groups_list');
}
}
2 changes: 2 additions & 0 deletions build/integration/features/bootstrap/ShareesContext.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,5 +22,7 @@ protected function resetAppConfigs() {
$this->deleteServerConfig('core', 'shareapi_only_share_with_group_members');
$this->deleteServerConfig('core', 'shareapi_allow_share_dialog_user_enumeration');
$this->deleteServerConfig('core', 'shareapi_allow_group_sharing');
$this->deleteServerConfig('core', 'shareapi_exclude_groups');
$this->deleteServerConfig('core', 'shareapi_exclude_groups_list');
}
}
164 changes: 164 additions & 0 deletions build/integration/features/contacts-menu.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,170 @@ Feature: contacts-menu



Scenario: users can not be searched by display name when searcher belongs to a group excluded from sharing
Given user "user0" exists
And group "ExcludedGroup" exists
And user "user0" belongs to group "ExcludedGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ExcludedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | displayname |
| value | Test name |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "0" contacts

Scenario: users can not be searched by email when searcher belongs to a group excluded from sharing
Given user "user0" exists
And group "ExcludedGroup" exists
And user "user0" belongs to group "ExcludedGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ExcludedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | email |
| value | test@example.com |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "0" contacts

Scenario: users can not be searched by display name when searcher belongs to both a group excluded from sharing and another group
Given user "user0" exists
And group "ExcludedGroup" exists
And user "user0" belongs to group "ExcludedGroup"
And group "AnotherGroup" exists
And user "user0" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ExcludedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | displayname |
| value | Test name |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "0" contacts

Scenario: users can not be searched by email when searcher belongs to both a group excluded from sharing and another group
Given user "user0" exists
And group "ExcludedGroup" exists
And user "user0" belongs to group "ExcludedGroup"
And group "AnotherGroup" exists
And user "user0" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ExcludedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | email |
| value | test@example.com |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "0" contacts

Scenario: users can be searched by display name when searcher does not belong to a group excluded from sharing
Given user "user0" exists
And group "ExcludedGroup" exists
And group "AnotherGroup" exists
And user "user0" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ExcludedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | displayname |
| value | Test name |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "1" contacts
And searched contact "0" is named "Test name"

Scenario: users can be searched by email when searcher does not belong to a group excluded from sharing
Given user "user0" exists
And group "ExcludedGroup" exists
And group "AnotherGroup" exists
And user "user0" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ExcludedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | email |
| value | test@example.com |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "1" contacts
And searched contact "0" is named "user1"

Scenario: users can not be searched by display name when searcher does not belong to a group allowed to share
Given user "user0" exists
And group "AllowedGroup" exists
And parameter "shareapi_exclude_groups" of app "core" is set to "allow"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "AllowedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | displayname |
| value | Test name |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "0" contacts

Scenario: users can not be searched by email when searcher does not belong to a group allowed to share
Given user "user0" exists
And group "AllowedGroup" exists
And parameter "shareapi_exclude_groups" of app "core" is set to "allow"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "AllowedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | email |
| value | test@example.com |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "0" contacts

Scenario: users can be searched by display name when searcher belongs to both a group allowed to share and another group
Given user "user0" exists
And group "AllowedGroup" exists
And user "user0" belongs to group "AllowedGroup"
And group "AnotherGroup" exists
And user "user0" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "allow"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "AllowedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | displayname |
| value | Test name |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "1" contacts
And searched contact "0" is named "Test name"

Scenario: users can be searched by email when searcher belongs to both a group allowed to share and another group
Given user "user0" exists
And group "AllowedGroup" exists
And user "user0" belongs to group "AllowedGroup"
And group "AnotherGroup" exists
And user "user0" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "allow"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "AllowedGroup"
And user "user1" exists
And As an "admin"
And sending "PUT" to "/cloud/users/user1" with
| key | email |
| value | test@example.com |
When Logging in using web as "user0"
And searching for contacts matching with "test"
Then the list of searched contacts has "1" contacts
And searched contact "0" is named "user1"



Scenario: users can not be found by display name if visibility is private
Given user "user0" exists
And user "user1" exists
Expand Down
91 changes: 91 additions & 0 deletions build/integration/sharees_features/sharees.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,97 @@ Feature: sharees
And "exact remotes" sharees returned is empty
And "remotes" sharees returned is empty

Scenario: Search when belonging to a group excluded from sharing
Given As an "test"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ShareeGroup"
When getting sharees for
| search | sharee |
| itemType | file |
Then the OCS status code should be "100"
And the HTTP status code should be "200"
And "exact users" sharees returned is empty
And "users" sharees returned is empty
And "exact groups" sharees returned is empty
And "groups" sharees returned is empty
And "exact remotes" sharees returned is empty
And "remotes" sharees returned is empty

Scenario: Search when belonging to both a group excluded from sharing and another group
Given As an "test"
And group "AnotherGroup" exists
And user "test" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ShareeGroup"
When getting sharees for
| search | sharee |
| itemType | file |
Then the OCS status code should be "100"
And the HTTP status code should be "200"
And "exact users" sharees returned is empty
And "users" sharees returned is empty
And "exact groups" sharees returned is empty
And "groups" sharees returned is empty
And "exact remotes" sharees returned is empty
And "remotes" sharees returned is empty

Scenario: Search when belonging to a group not excluded from sharing
Given As an "test"
And group "AnotherGroup" exists
And user "test" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "yes"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "ExcludedGroup"
When getting sharees for
| search | sharee |
| itemType | file |
Then the OCS status code should be "100"
And the HTTP status code should be "200"
And "exact users" sharees returned is empty
And "users" sharees returned are
| Sharee1 | 0 | Sharee1 |
And "exact groups" sharees returned is empty
And "groups" sharees returned are
| ShareeGroup | 1 | ShareeGroup |
And "exact remotes" sharees returned is empty
And "remotes" sharees returned is empty

Scenario: Search when not belonging to a group allowed to share
Given As an "test"
And group "AnotherGroup" exists
And parameter "shareapi_exclude_groups" of app "core" is set to "allow"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "AnotherGroup"
When getting sharees for
| search | sharee |
| itemType | file |
Then the OCS status code should be "100"
And the HTTP status code should be "200"
And "exact users" sharees returned is empty
And "users" sharees returned is empty
And "exact groups" sharees returned is empty
And "groups" sharees returned is empty
And "exact remotes" sharees returned is empty
And "remotes" sharees returned is empty

Scenario: Search when belonging to both a group allowed to share and another group
Given As an "test"
And group "AnotherGroup" exists
And user "test" belongs to group "AnotherGroup"
And parameter "shareapi_exclude_groups" of app "core" is set to "allow"
And parameter "shareapi_exclude_groups_list" of app "core" is set to "AnotherGroup"
When getting sharees for
| search | sharee |
| itemType | file |
Then the OCS status code should be "100"
And the HTTP status code should be "200"
And "exact users" sharees returned is empty
And "users" sharees returned are
| Sharee1 | 0 | Sharee1 |
And "exact groups" sharees returned is empty
And "groups" sharees returned are
| ShareeGroup | 1 | ShareeGroup |
And "exact remotes" sharees returned is empty
And "remotes" sharees returned is empty

Scenario: Search without exact match no iteration allowed
Given As an "test"
And parameter "shareapi_allow_share_dialog_user_enumeration" of app "core" is set to "no"
Expand Down
4 changes: 2 additions & 2 deletions dist/settings-vue-settings-admin-sharing.js
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/settings-vue-settings-admin-sharing.js.map
View file
Open in desktop

Large diffs are not rendered by default.

29 changes: 5 additions & 24 deletions lib/private/Contacts/ContactsMenu/ContactsStore.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@

use OC\KnownUser\KnownUserService;
use OC\Profile\ProfileManager;
use OC\Share20\ShareDisableChecker;
use OCA\UserStatus\Db\UserStatus;
use OCA\UserStatus\Service\StatusService;
use OCP\Contacts\ContactsMenu\IContactsStore;
Expand Down Expand Up @@ -38,6 +39,7 @@ public function __construct(
private IGroupManager $groupManager,
private KnownUserService $knownUserService,
private IL10NFactory $l10nFactory,
private ShareDisableChecker $shareDisableChecker,
) {
}

Expand Down Expand Up @@ -148,8 +150,8 @@ public function getContacts(IUser $user, ?string $filter, ?int $limit = null, ?i
* Filters the contacts. Applied filters:
* 1. if the `shareapi_allow_share_dialog_user_enumeration` config option is
* enabled it will filter all local users
* 2. if the `shareapi_exclude_groups` config option is enabled and the
* current user is in an excluded group it will filter all local users.
* 2. if sharing is disabled for the current user by the `shareapi_exclude_groups`
* config option it will filter all local users.
* 3. if the `shareapi_only_share_with_group_members` config option is
* enabled it will filter all users which doesn't have a common group
* with the current user.
Expand All @@ -169,34 +171,13 @@ private function filterContacts(
$restrictEnumerationGroup = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_group', 'no') === 'yes';
$restrictEnumerationPhone = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_phone', 'no') === 'yes';
$allowEnumerationFullMatch = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match', 'yes') === 'yes';
$excludeGroups = $this->config->getAppValue('core', 'shareapi_exclude_groups', 'no');

// whether to filter out local users
$skipLocal = false;
$skipLocal = $this->shareDisableChecker->sharingDisabledForUser($self->getUID());
// whether to filter out all users which don't have a common group as the current user
$ownGroupsOnly = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members', 'no') === 'yes';

$selfGroups = $this->groupManager->getUserGroupIds($self);

if ($excludeGroups && $excludeGroups !== 'no') {
$excludedGroups = $this->config->getAppValue('core', 'shareapi_exclude_groups_list', '');
$decodedExcludeGroups = json_decode($excludedGroups, true);
$excludeGroupsList = $decodedExcludeGroups ?? [];

if ($excludeGroups != 'allow') {
if (count(array_intersect($excludeGroupsList, $selfGroups)) !== 0) {
// a group of the current user is excluded -> filter all local users
$skipLocal = true;
}
} else {
$skipLocal = true;
if (count(array_intersect($excludeGroupsList, $selfGroups)) !== 0) {
// a group of the current user is allowed -> do not filter all local users
$skipLocal = false;
}
}
}

// ownGroupsOnly : some groups may be excluded
if ($ownGroupsOnly) {
$excludeGroupsFromOwnGroups = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members_exclude_group_list', '');
Expand Down
Loading
Loading