Skip to content

Commit 4a8a75b

Browse files
smariniersmarinier
committed
New core setting : shareapi_only_share_with_group_members_exclude_group_list (issue 37677)
Signed-off-by: Sebastien Marinier <sebastien.marinier@arawa.fr>
1 parent 74f31ba commit 4a8a75b

File tree

13 files changed

+106
-2
lines changed

13 files changed

+106
-2
lines changed

‎apps/settings/l10n/en_GB.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,7 @@ OC.L10N.register(
483483
"Allow resharing" : "Allow resharing",
484484
"Allow sharing with groups" : "Allow sharing with groups",
485485
"Restrict users to only share with users in their groups" : "Restrict users to only share with users in their groups",
486+
"Exclude some groups from sharing with users in their group" : "Exclude some groups from sharing with users in their group",
486487
"Exclude groups from sharing" : "Exclude groups from sharing",
487488
"These groups will still be able to receive shares, but not to initiate them." : "These groups will still be able to receive shares, but not to initiate them.",
488489
"Allow username autocompletion in share dialog" : "Allow username autocompletion in share dialogue",

‎apps/settings/l10n/en_GB.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,7 @@
481481
"Allow resharing" : "Allow resharing",
482482
"Allow sharing with groups" : "Allow sharing with groups",
483483
"Restrict users to only share with users in their groups" : "Restrict users to only share with users in their groups",
484+
"Exclude some groups from sharing with users in their group" : "Exclude some groups from sharing with users in their group",
484485
"Exclude groups from sharing" : "Exclude groups from sharing",
485486
"These groups will still be able to receive shares, but not to initiate them." : "These groups will still be able to receive shares, but not to initiate them.",
486487
"Allow username autocompletion in share dialog" : "Allow username autocompletion in share dialogue",

‎apps/settings/l10n/fr.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,7 @@ OC.L10N.register(
483483
"Allow resharing" : "Autoriser le repartage",
484484
"Allow sharing with groups" : "Autoriser le partage avec les groupes",
485485
"Restrict users to only share with users in their groups" : "N'autoriser les partages qu'entre membres de mêmes groupes",
486+
"Exclude some groups from sharing with users in their group" : "Empêcher certains groupes de partager avec les utilisateurs de leur groupe",
486487
"Exclude groups from sharing" : "Empêcher certains groupes de partager",
487488
"These groups will still be able to receive shares, but not to initiate them." : "Ces groupes ne pourront plus initier de partage, mais ils pourront toujours rejoindre les partages faits par d'autres. ",
488489
"Allow username autocompletion in share dialog" : "Autoriser l'autocomplétion du nom d'utilisateur dans la boite de dialogue de partage",

‎apps/settings/l10n/fr.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,7 @@
481481
"Allow resharing" : "Autoriser le repartage",
482482
"Allow sharing with groups" : "Autoriser le partage avec les groupes",
483483
"Restrict users to only share with users in their groups" : "N'autoriser les partages qu'entre membres de mêmes groupes",
484+
"Exclude some groups from sharing with users in their group" : "Empêcher certains groupes de partager avec les utilisateurs de leur groupe",
484485
"Exclude groups from sharing" : "Empêcher certains groupes de partager",
485486
"These groups will still be able to receive shares, but not to initiate them." : "Ces groupes ne pourront plus initier de partage, mais ils pourront toujours rejoindre les partages faits par d'autres. ",
486487
"Allow username autocompletion in share dialog" : "Autoriser l'autocomplétion du nom d'utilisateur dans la boite de dialogue de partage",

‎apps/settings/lib/Settings/Admin/Sharing.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,9 @@ public function getForm() {
7676
$excludedPasswordGroupsList = !is_null(json_decode($excludedPasswordGroups))
7777
? implode('|', json_decode($excludedPasswordGroups, true)) : '';
7878

79+
$shareWithGroupMembersExcludeGroups = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members_exclude_group_list', '');
80+
$shareWithGroupMembersExcludeGroupsList = !is_null(json_decode($shareWithGroupMembersExcludeGroups))
81+
? implode('|', json_decode($shareWithGroupMembersExcludeGroups, true)) : '';
7982

8083
$parameters = [
8184
// Built-In Sharing
@@ -96,6 +99,7 @@ public function getForm() {
9699
'passwordExcludedGroups' => $excludedPasswordGroupsList,
97100
'passwordExcludedGroupsFeatureEnabled' => $this->config->getSystemValueBool('sharing.allow_disabled_password_enforcement_groups', false),
98101
'onlyShareWithGroupMembers' => $this->shareManager->shareWithGroupMembersOnly(),
102+
'shareWithGroupMembersExcludeGroupsList'=> $shareWithGroupMembersExcludeGroupsList,
99103
'shareAPIEnabled' => $this->config->getAppValue('core', 'shareapi_enabled', 'yes'),
100104
'shareDefaultExpireDateSet' => $this->config->getAppValue('core', 'shareapi_default_expire_date', 'no'),
101105
'shareExpireAfterNDays' => $this->config->getAppValue('core', 'shareapi_expire_after_n_days', '7'),

‎apps/settings/src/admin.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
window.addEventListener('DOMContentLoaded', () => {
2-
$('#excludedGroups,#linksExcludedGroups,#passwordsExcludedGroups').each(function(index, element) {
2+
$('#excludedGroups,#shareGroupMembersExcludeGroups,#linksExcludedGroups,#passwordsExcludedGroups').each(function(index, element) {
33
OC.Settings.setupGroupsSelect($(element))
44
$(element).change(function(ev) {
55
let groups = ev.val || []
@@ -214,6 +214,10 @@ window.addEventListener('DOMContentLoaded', () => {
214214
$('#selectExcludedGroups').toggleClass('hidden', !this.checked)
215215
})
216216

217+
$('#onlyShareWithGroupMembers').change(function() {
218+
$('#selectShareWithGroupMembersExcludeGroups').toggleClass('hidden', !this.checked)
219+
})
220+
217221
const setupChecks = () => {
218222
// run setup checks then gather error messages
219223
$.when(

‎apps/settings/templates/settings/admin/sharing.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,13 @@
185185
} ?> />
186186
<label for="onlyShareWithGroupMembers"><?php p($l->t('Restrict users to only share with users in their groups'));?></label><br/>
187187
</p>
188+
<p id="selectShareWithGroupMembersExcludeGroups" class="indent <?php if (!$_['onlyShareWithGroupMembers'] || $_['shareAPIEnabled'] === 'no') {
189+
p('hidden');
190+
} ?>">
191+
<em><?php p($l->t('Exclude some groups from sharing with users in their group')); ?></em>
192+
<br />
193+
<input name="shareapi_only_share_with_group_members_exclude_group_list" type="hidden" id="shareGroupMembersExcludeGroups" value="<?php p($_['shareWithGroupMembersExcludeGroupsList']) ?>" style="width: 400px" class="noJSAutoUpdate"/>
194+
</p>
188195
<p class="<?php if ($_['shareAPIEnabled'] === 'no') {
189196
p('hidden');
190197
}?>">

‎lib/private/Collaboration/Collaborators/GroupPlugin.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ class GroupPlugin implements ISearchPlugin {
4545
protected $shareeEnumerationInGroupOnly;
4646
/** @var bool */
4747
protected $groupSharingDisabled;
48+
/** @var array */
49+
protected $shareWithGroupOnlyExcludeGroupsList;
4850

4951
/** @var IGroupManager */
5052
private $groupManager;
@@ -62,6 +64,14 @@ public function __construct(IConfig $config, IGroupManager $groupManager, IUserS
6264
$this->shareWithGroupOnly = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members', 'no') === 'yes';
6365
$this->shareeEnumerationInGroupOnly = $this->shareeEnumeration && $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_group', 'no') === 'yes';
6466
$this->groupSharingDisabled = $this->config->getAppValue('core', 'shareapi_allow_group_sharing', 'yes') === 'no';
67+
68+
if ($this->shareWithGroupOnly) {
69+
$shareWithGroupOnlyExcludeGroups = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members_exclude_group_list', '');
70+
$decodedExcludeGroups = json_decode($shareWithGroupOnlyExcludeGroups, true);
71+
$this->shareWithGroupOnlyExcludeGroupsList = $decodedExcludeGroups ?? [];
72+
} else {
73+
$this->shareWithGroupOnlyExcludeGroupsList = [];
74+
}
6575
}
6676

6777
public function search($search, $limit, $offset, ISearchResult $searchResult) {
@@ -89,6 +99,9 @@ public function search($search, $limit, $offset, ISearchResult $searchResult) {
8999
return $group->getGID();
90100
}, $userGroups);
91101
$groupIds = array_intersect($groupIds, $userGroups);
102+
103+
// ShareWithGroupOnly filtering
104+
$groupIds = array_diff( $groupIds, $this->shareWithGroupOnlyExcludeGroupsList);
92105
}
93106

94107
$lowerSearch = strtolower($search);

‎lib/private/Collaboration/Collaborators/MailPlugin.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ class MailPlugin implements ISearchPlugin {
5353
protected $shareeEnumerationFullMatch;
5454
/* @var bool */
5555
protected $shareeEnumerationFullMatchEmail;
56+
/** @var array */
57+
protected $shareWithGroupOnlyExcludeGroupsList;
5658

5759
/** @var IManager */
5860
private $contactsManager;
@@ -91,6 +93,14 @@ public function __construct(IManager $contactsManager,
9193
$this->shareeEnumerationPhone = $this->shareeEnumeration && $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_to_phone', 'no') === 'yes';
9294
$this->shareeEnumerationFullMatch = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match', 'yes') === 'yes';
9395
$this->shareeEnumerationFullMatchEmail = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_email', 'yes') === 'yes';
96+
97+
if ($this->shareWithGroupOnly) {
98+
$shareWithGroupOnlyExcludeGroups = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members_exclude_group_list', '');
99+
$decodedExcludeGroups = json_decode($shareWithGroupOnlyExcludeGroups, true);
100+
$this->shareWithGroupOnlyExcludeGroupsList = $decodedExcludeGroups ?? [];
101+
} else {
102+
$this->shareWithGroupOnlyExcludeGroupsList = [];
103+
}
94104
}
95105

96106
/**
@@ -150,6 +160,10 @@ public function search($search, $limit, $offset, ISearchResult $searchResult) {
150160
* Check if the user may share with the user associated with the e-mail of the just found contact
151161
*/
152162
$userGroups = $this->groupManager->getUserGroupIds($this->userSession->getUser());
163+
164+
// ShareWithGroupOnly filtering
165+
$userGroups = array_diff( $userGroups, $this->shareWithGroupOnlyExcludeGroupsList);
166+
153167
$found = false;
154168
foreach ($userGroups as $userGroup) {
155169
if ($this->groupManager->isInGroup($contact['UID'], $userGroup)) {

‎lib/private/Collaboration/Collaborators/UserPlugin.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ class UserPlugin implements ISearchPlugin {
6060
protected $shareeEnumerationFullMatchEmail;
6161
/* @var bool */
6262
protected $shareeEnumerationFullMatchIgnoreSecondDisplayName;
63+
/** @var array */
64+
protected $shareWithGroupOnlyExcludeGroupsList;
6365

6466
/** @var IConfig */
6567
private $config;
@@ -96,6 +98,14 @@ public function __construct(IConfig $config,
9698
$this->shareeEnumerationFullMatchUserId = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_userid', 'yes') === 'yes';
9799
$this->shareeEnumerationFullMatchEmail = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_email', 'yes') === 'yes';
98100
$this->shareeEnumerationFullMatchIgnoreSecondDisplayName = $this->config->getAppValue('core', 'shareapi_restrict_user_enumeration_full_match_ignore_second_dn', 'no') === 'yes';
101+
102+
if ($this->shareWithGroupOnly) {
103+
$shareWithGroupOnlyExcludeGroups = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members_exclude_group_list', '');
104+
$decodedExcludeGroups = json_decode($shareWithGroupOnlyExcludeGroups, true);
105+
$this->shareWithGroupOnlyExcludeGroupsList = $decodedExcludeGroups ?? [];
106+
} else {
107+
$this->shareWithGroupOnlyExcludeGroupsList = [];
108+
}
99109
}
100110

101111
public function search($search, $limit, $offset, ISearchResult $searchResult) {
@@ -105,6 +115,10 @@ public function search($search, $limit, $offset, ISearchResult $searchResult) {
105115

106116
$currentUserId = $this->userSession->getUser()->getUID();
107117
$currentUserGroups = $this->groupManager->getUserGroupIds($this->userSession->getUser());
118+
119+
// ShareWithGroupOnly filtering
120+
$currentUserGroups = array_diff( $currentUserGroups, $this->shareWithGroupOnlyExcludeGroupsList);
121+
108122
if ($this->shareWithGroupOnly || $this->shareeEnumerationInGroupOnly) {
109123
// Search in all the groups this user is part of
110124
foreach ($currentUserGroups as $userGroupId) {

0 commit comments

Comments
 (0)