nextcloud / nextcloud/announcementcenter
Announcement center "admins" can see every announcement
Open
Nobody has claimed this yet.
1. to develop
enhancement
feature: administration 🙆
feature: announcements 🗣️
- Dominant language
- JavaScript
- Stars
- 51
- Forks
- 29
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 22
Description
Steps to reproduce
- add user 'user1' to group 'test'
- add group 'test' in settings to announcement center admin-groups
- post an announcement with user 'user2' to another group (not a group which user1 belongs to).
- user1 is able to see the announcement
Expected behaviour
user1 should only see his own announcements and announcements of his groups.
Actual behaviour
user1 is able to see every announcement. It is a breach of privacy if a user can see announcements that are intended exclusively for another group.
Nextcloud version:
16.0.5.1
Announcement Center version:
3.5.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the four listed steps with Nextcloud 16.0.5.1 and Announcement Center 3.5.1, then trace how announcement-center admin groups affect visibility. Done means user1 sees only personal announcements and announcements for groups user1 belongs to, while announcements for other groups remain hidden.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100