Share function restrictions not applied
Open
Nobody has claimed this yet.
0. Needs triage
bug
- Dominant language
- JavaScript
- Stars
- 177
- Forks
- 68
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 60
Description
Currently this app (version 0.13.6) is not fully applying restrictions about sharing (core settings). Users can enumerate all users and foreign groups, even if sharing is only allowed inside the own groups. This is especially a privacy issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior in version 0.13.6 with sharing restricted to the user's own groups, checking whether all users and foreign groups can still be enumerated. Trace the core settings and sharing-related entry points to identify where the restriction is bypassed. Done means users and foreign groups are no longer visible when that restriction is enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100