nextcloud
fix: Unify handling of exclude groups in contacts menu and sharing
If the current user belongs to both one or more groups excluded from sharing and one or more groups not excluded from sharing the user is allowed to share. However, in the contacts menu, as soon as the current user belonged to a group excluded from sharing the user could not search for local contacts. This has been unified now with the sharing behaviour, so local contacts can still be searched if the user also belongs to a group not excluded from sharing (or to no group at all, which was also allowed before).
Important
Being able to share if the current user belongs to both groups excluded from sharing and other groups has been there since handling excluded groups was added for sharing. There is unfortunately no context about it (it seems to predate Nextcloud). However, unifying the behaviour between sharing and contacts menu to be like in the contacts menu (that is, preventing sharing) could be a breaking behaviour change.
On the other hand, not showing the contacts when belonging to both groups excluded from sharing and other groups was an explicit decision when adding handling of excluded groups for contacts. However, it might be just a cautious implementation to fix the issues described in https://github.com/nextcloud/server/issues/5107, and in any case it does not prevent finding other local users due to those users appearing as internal share candidates. Therefore, unifying the behaviour to show the contacts when belonging to both excluded and not excluded groups should not be problematic... but please double check that I did not miss anything :-)
How to test
- Create user target
- Create groups excluded and other
- Create user searcher and add it to both groups
- Exclude group excluded from sharing:
occ config:app:set core shareapi_exclude_groups --type string --value yes
occ config:app:set core shareapi_exclude_groups_list --type array --value '["excluded"]'
- Log in as user searcher
- Open the Files app
- Open the Sharing tab for a file
- In the internal shares, search for target; it should appear
- In the contacts menu, search for target
Result with this pull request
User Target appears in the contacts menu, just like in the share candidates
Result without this pull request
User Target does not appear in the contacts menu
