Skip to content

Remove user name from public sharing page - #19913

Merged
rullzer merged 2 commits into
masterfrom
bugfix/noid/remove-user-name-from-public-sharing-page
Apr 3, 2020
Merged

Remove user name from public sharing page#19913
rullzer merged 2 commits into
masterfrom
bugfix/noid/remove-user-name-from-public-sharing-page

Conversation

@nickvergessen

Copy link
Copy Markdown
Member

Need to check the fallback from:

_legacyCreateFederatedShare: function(remote,token,owner,ownerDisplayName,name,isProtected){
varself=this;
varlocation=window.location.protocol+'//'+window.location.host+OC.getRootPath();
if(remote.substr(-1)!=='/'){
remote+='/'
}
varurl=remote+'index.php/apps/files#'+'remote='+encodeURIComponent(location)// our location is the remote for the other server
+"&token="+encodeURIComponent(token)+"&owner="+encodeURIComponent(owner)+"&ownerDisplayName="+encodeURIComponent(ownerDisplayName)+"&name="+encodeURIComponent(name)+"&protected="+isProtected;
if(remote.indexOf('://')>0){
OC.redirect(url);
}else{
// if no protocol is specified, we automatically detect it by testing https and http
// this check needs to happen on the server due to the Content Security Policy directive
$.get(OC.generateUrl('apps/files_sharing/testremote'),{remote: remote}).then(function(protocol){
if(protocol!=='http'&&protocol!=='https'){
self._toggleLoading();
OC.dialogs.alert(t('files_sharing','No compatible server found at {remote}',{remote: remote}),
t('files_sharing','Invalid server URL'));
}else{
OC.redirect(protocol+'://'+url);
}
});
}
},

It seems like at least the userId is required to be leaked non the less, if we want to continue having this fallback available.

@rullzer

Copy link
Copy Markdown
Member

test say no

Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
nickvergessenforce-pushed the bugfix/noid/remove-user-name-from-public-sharing-page branch from fb7c224 to 1c4422cCompareApril 1, 2020 15:16
@rullzer
rullzer merged commit 475d549 into masterApr 3, 2020
@rullzer
rullzer deleted the bugfix/noid/remove-user-name-from-public-sharing-page branch April 3, 2020 08:33
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@nickvergessen@rullzer@skjnldsv