From 6faed643be3b0c81dd4d26887b639ec270a7cbe5 Mon Sep 17 00:00:00 2001 From: David Dreschner Date: Sat, 11 Jul 2026 00:17:20 +0200 Subject: [PATCH] fix(UserPlugin): Don't return disabled users on user ID and mail match Assisted-by: ClaudeCode:claude-fable-5 Signed-off-by: David Dreschner --- .../sharees_features/sharees.feature | 49 +++++++++++++++++++ .../Collaborators/UserPlugin.php | 7 ++- 2 files changed, 54 insertions(+), 2 deletions(-) diff --git a/build/integration/sharees_features/sharees.feature b/build/integration/sharees_features/sharees.feature index b54440866a9c0..97994472c0cbe 100644 --- a/build/integration/sharees_features/sharees.feature +++ b/build/integration/sharees_features/sharees.feature @@ -51,6 +51,24 @@ Feature: sharees And "exact remotes" sharees returned is empty And "remotes" sharees returned is empty + Scenario: Search without exact match does not return disabled users + Given As an "admin" + And assure user "Sharee1" is disabled + And As an "test" + When getting sharees for + | search | Sharee | + | itemType | file | + Then the OCS status code should be "100" + And the HTTP status code should be "200" + And "exact users" sharees returned is empty + And "users" sharees returned are + | Sharee2 | 0 | Sharee2 | sharee2@system.com | + And "exact groups" sharees returned is empty + And "groups" sharees returned are + | ShareeGroup | 1 | ShareeGroup | + And "exact remotes" sharees returned is empty + And "remotes" sharees returned is empty + Scenario: Search only with group members - denied Given As an "test" And parameter "shareapi_only_share_with_group_members" of app "core" is set to "yes" @@ -254,6 +272,22 @@ Feature: sharees Then "exact remotes" sharees returned is empty Then "remotes" sharees returned is empty + Scenario: Search with exact match does not return disabled users + Given As an "admin" + And assure user "Sharee1" is disabled + And As an "test" + When getting sharees for + | search | Sharee1 | + | itemType | file | + Then the OCS status code should be "100" + And the HTTP status code should be "200" + And "exact users" sharees returned is empty + And "users" sharees returned is empty + And "exact groups" sharees returned is empty + And "groups" sharees returned is empty + And "exact remotes" sharees returned is empty + And "remotes" sharees returned is empty + Scenario: Search with exact match not-exact casing Given As an "test" When getting sharees for @@ -364,6 +398,21 @@ Feature: sharees And "exact emails" sharees returned is empty And "emails" sharees returned is empty + Scenario: Search user by system e-mail address does not return disabled users + Given As an "admin" + And assure user "Sharee2" is disabled + And As an "test" + When getting sharees for + | search | sharee2@system.com | + | itemType | file | + | shareType | 0 | + Then the OCS status code should be "100" + And the HTTP status code should be "200" + And "exact users" sharees returned is empty + And "users" sharees returned is empty + And "exact emails" sharees returned is empty + And "emails" sharees returned is empty + Scenario: Search user by system e-mail address without exact match Given As an "test" When getting sharees for diff --git a/lib/private/Collaboration/Collaborators/UserPlugin.php b/lib/private/Collaboration/Collaborators/UserPlugin.php index fc71490472952..3ffbdf7c3617e 100644 --- a/lib/private/Collaboration/Collaborators/UserPlugin.php +++ b/lib/private/Collaboration/Collaborators/UserPlugin.php @@ -105,7 +105,7 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b // User backends may also resolve email addresses or other login names here // (e.g. for login via email). Only an actual user id match counts as user id // full match, everything else is governed by the email setting below. - if ($user !== null && mb_strtolower($user->getUID()) === $lowerSearch) { + if ($user !== null && $user->isEnabled() && mb_strtolower($user->getUID()) === $lowerSearch) { $users[$user->getUID()] = ['exact', $user]; } } @@ -122,7 +122,10 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b $uid = $row['uid']; $email = $row['value']; $isAdditional = $row['name'] === 'additional_mail'; - $users[$uid] = ['exact', $this->userManager->get($uid), $isAdditional ? $email : null]; + $user = $this->userManager->get($uid); + if ($user !== null && $user->isEnabled()) { + $users[$uid] = ['exact', $user, $isAdditional ? $email : null]; + } } $result->closeCursor(); }