nextcloud / nextcloud/server

[Bug]: Reference metadata fetching returns data from apps disabled for guests

Open
#34,279 4 comments 0 reactions 1 assignee View on GitHub

@juliusknorr is already working on this.

Since Oct 1, 2022.

1. to develop 25-feedback bug high
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

⚠️ This issue respects the following points: ⚠️
  • This is a bug, not a question or a configuration/webserver/proxy issue.
  • This issue is not already reported on Github (I've searched it).
  • Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
  • Nextcloud Server is running on 64bit capable CPU, PHP and OS.
  • I agree to follow Nextcloud's Code of Conduct.
Bug description

On c.nc.c the github integration app is not enabled for guests, still when there's a github link in talk, data is returned and rendered by the link preview functionality. Is this intended or should reference metadata fetching fallback to open-graph when a guest user is not allwed to use gitub integration?

Talk PR https://github.com/nextcloud/spreed/pull/7822
Server PR https://github.com/nextcloud/server/pull/33494

Steps to reproduce
  1. Use a guest account and login to c.nc.c
  2. Join a public room and look for a link to a github issue/pr or post one
  3. Note that data is rendered as a github integration widget and not as a open graph one
Expected behavior

Not absolutely sure, but I would expect that if an user is not allowed to use an app, it should not be possible to retrieve any data from that app?!

Installation method

No response

Operating system

No response

PHP engine version

No response

Web server

No response

Database engine version

No response

Is this bug present after an update or on a fresh install?

No response

Are you using the Nextcloud Server Encryption module?

No response

What user-backends are you using?
  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other
Configuration report

No response

List of activated Apps
Enabled:
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contactsinteraction: 1.6.0
  - dashboard: 7.5.0
  - dav: 1.24.0
  - federatedfilesharing: 1.15.0
  - federation: 1.15.0
  - files: 1.20.0
  - files_sharing: 1.17.0
  - files_trashbin: 1.15.0
  - files_versions: 1.18.0
  - integration_github: 1.0.6
  - lookup_server_connector: 1.13.0
  - oauth2: 1.13.0
  - provisioning_api: 1.15.0
  - settings: 1.7.0
  - sharebymail: 1.15.0
  - spreed: 15.0.0-beta.4
  - systemtags: 1.15.0
  - theming: 2.0.0
  - twofactor_backupcodes: 1.14.0
  - updatenotification: 1.15.0
  - user_status: 1.5.0
  - weather_status: 1.5.0
  - workflowengine: 2.7.0
Disabled:
  - admin_audit
  - encryption
  - files_external
  - testing
  - user_ldap
Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.