server [Bug]: Wrong user name in log for system events

⚠️ This issue respects the following points: ⚠️

[X] This is a bug, not a question or a configuration/webserver/proxy issue.
[X] This issue is not already reported on Github (I've searched it).
[x] Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
[X] I agree to follow Nextcloud's Code of Conduct.

Bug description

We deploy NC at a school. Last night our teachers received an email notification stating they had been added to the group "teachers" by a certain user. This user was a seventh-grade pupil. Naturally, pupils are unprivileged users who could never have initiated this event. However, the message that a seventh-grade pupil apparently had the power of adding users to the "teachers" group caused … considerable concern among teachers.

Analysis

Checking the nextcloud/auditing log revealed that the respective user is actually listed as the initiating user for all kinds of "system events", such as old file versions having been deleted. This is clearly wrong. The wrong username is not randomly picked, it's the name of the alphabetically first known user (who happens to be that seventh-grade pupil in our case). So users who should receive the notifiaction "An administrator has added you to the group …" instead receive "[wrong-username] has added you to the group …".

I remember that notifications were correct in the past, this bug must have been introduced with one of the later updates to NC 22. We are unable to upgrade at this moment, so I cannot be sure if it is present in NC 23.

Steps to reproduce

unclear

Expected behavior

logs (and notifications) have "an administrator" for system events, not the name of the alphabetically first known user.

Installation method

Manual installation

Operating system

Linux (Ubuntu Server)

PHP engine version

PHP 7.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a minor version (ex. 22.2.3 to 22.2.4)

Are you using the Nextcloud Server Encryption module?

No.

What user-backends are you using?

[X] Default user-backend (database)
[X] LDAP/ Active Directory
[ ] SSO - SAML
[ ] Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/cloud.kg-fds.de\/",
        "overwriteprotocol": "https",
        "htaccess.RewriteBase": "\/",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "10.16.112.16",
            "cloud.kg-fds.de",
            "nextcloud.kg-fds.de"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "22.2.6.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "default_locale": "de_DE",
        "default_language": "de",
        "app_install_overwrite": [
            "ldaporg",
            "files_external_onedrive",
            "auto_mail_accounts",
            "ldapcontacts"
        ],
        "maintenance": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0
        },
        "skeletondirectory": "data\/skeleton-kepler",
        "theme": "",
        "loglevel": 2,
        "sharing.enable_share_mail": false,
        "default_phone_region": "DE",
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        }
    }
}

List of activated Apps

Enabled:
  - accessibility: 1.8.0
  - activity: 2.15.0
  - admin_audit: 1.12.0
  - appointments: 1.12.2
  - apporder: 0.15.0
  - auto_groups: 1.4.0
  - bbb: 2.2.0
  - bookmarks: 10.2.1
  - calendar: 3.2.2
  - circles: 22.3.0
  - cloud_federation_api: 1.5.0
  - comments: 1.12.0
  - contacts: 4.1.0
  - dashboard: 7.2.0
  - dav: 1.20.0
  - external: 3.9.0
  - extract: 1.3.3
  - federatedfilesharing: 1.12.0
  - files: 1.17.0
  - files_downloadactivity: 1.12.0
  - files_external: 1.13.1
  - files_pdfviewer: 2.3.1
  - files_rightclick: 1.1.0
  - files_sharing: 1.14.0
  - files_texteditor: 2.14.0
  - files_trashbin: 1.12.0
  - files_versions: 1.15.0
  - files_videoplayer: 1.11.0
  - groupfolders: 10.0.2
  - logreader: 2.7.0
  - lookup_server_connector: 1.10.0
  - maps: 0.1.10
  - nextcloud_announcements: 1.11.0
  - notes: 4.3.1
  - notifications: 2.10.1
  - oauth2: 1.10.0
  - password_policy: 1.12.0
  - passwords: 2021.12.20
  - photos: 1.4.0
  - provisioning_api: 1.12.0
  - recommendations: 1.1.0
  - richdocuments: 4.2.5
  - serverinfo: 1.12.0
  - settings: 1.4.0
  - sharebymail: 1.12.0
  - spreed: 12.2.4
  - support: 1.5.0
  - text: 3.3.1
  - theming: 1.13.0
  - twofactor_backupcodes: 1.11.0
  - updatenotification: 1.12.0
  - user_ldap: 1.12.2
  - viewer: 1.6.0
  - weather_status: 1.2.0
  - welcome: 1.0.1
  - workflowengine: 2.4.0
Disabled:
  - audioplayer: 3.3.0
  - bruteforcesettings: 2.3.0
  - contactsinteraction: 1.3.0
  - encryption
  - federation: 1.12.0
  - files_mindmap: 0.0.26
  - firstrunwizard: 2.11.0
  - integration_moodle: 1.0.2
  - integration_onedrive: 1.1.2
  - integration_twitter: 1.0.2
  - integration_whiteboard: 0.0.14
  - jitsi: 0.14.0
  - ldap_contacts_backend: 1.2.0
  - ldapcontacts: 2.0.5
  - mail: 1.11.7
  - music: 1.5.1
  - privacy: 1.6.0
  - survey_client: 1.10.0
  - systemtags: 1.12.0
  - tasks: 0.14.4
  - user_status: 1.1.1
  - workflow_pdf_converter: 1.7.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

One example entry:

{"reqId":"rLbKjg96GHmAtb12QjqX","level":1,"time":"2022-04-06T12:21:12+00:00","remoteAddr":"","user":"<***name of pupil removed***>","app":"admin_audit","method":"","url":"--","message":"File \"/files_trashbin/files/Demo-DB 2022-02-07 2022-02-24.ttdbx.d1649011768\" deleted from trash bin.","userAgent":"--","version":"22.2.6.2"}

Additional info

No response

Apr 06 '22 15:04 ruedigerkupper

cc @nextcloud/security

Apr 06 '22 15:04 szaimen

Further information: The wrong user is an LDAP user. "teachers" is an LDAP group.

Apr 06 '22 16:04 ruedigerkupper

I don't believe the user actually gained administrator privileges, but the log entries are wrong.

Apr 06 '22 16:04 ruedigerkupper

@ruedigerkupper are your background jobs run per ajax, or cron? (check basic settings)