[Bug]: Reference metadata fetching returns data from apps disabled for guests
@juliusknorr is already working on this.
Since Oct 1, 2022.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
⚠️ This issue respects the following points: ⚠️
- This is a bug, not a question or a configuration/webserver/proxy issue.
- This issue is not already reported on Github (I've searched it).
- Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- Nextcloud Server is running on 64bit capable CPU, PHP and OS.
- I agree to follow Nextcloud's Code of Conduct.
Bug description
On c.nc.c the github integration app is not enabled for guests, still when there's a github link in talk, data is returned and rendered by the link preview functionality. Is this intended or should reference metadata fetching fallback to open-graph when a guest user is not allwed to use gitub integration?
Talk PR https://github.com/nextcloud/spreed/pull/7822
Server PR https://github.com/nextcloud/server/pull/33494
Steps to reproduce
- Use a guest account and login to c.nc.c
- Join a public room and look for a link to a github issue/pr or post one
- Note that data is rendered as a github integration widget and not as a open graph one
Expected behavior
Not absolutely sure, but I would expect that if an user is not allowed to use an app, it should not be possible to retrieve any data from that app?!
Installation method
No response
Operating system
No response
PHP engine version
No response
Web server
No response
Database engine version
No response
Is this bug present after an update or on a fresh install?
No response
Are you using the Nextcloud Server Encryption module?
No response
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
No response
List of activated Apps
Enabled:
- cloud_federation_api: 1.8.0
- comments: 1.15.0
- contactsinteraction: 1.6.0
- dashboard: 7.5.0
- dav: 1.24.0
- federatedfilesharing: 1.15.0
- federation: 1.15.0
- files: 1.20.0
- files_sharing: 1.17.0
- files_trashbin: 1.15.0
- files_versions: 1.18.0
- integration_github: 1.0.6
- lookup_server_connector: 1.13.0
- oauth2: 1.13.0
- provisioning_api: 1.15.0
- settings: 1.7.0
- sharebymail: 1.15.0
- spreed: 15.0.0-beta.4
- systemtags: 1.15.0
- theming: 2.0.0
- twofactor_backupcodes: 1.14.0
- updatenotification: 1.15.0
- user_status: 1.5.0
- weather_status: 1.5.0
- workflowengine: 2.7.0
Disabled:
- admin_audit
- encryption
- files_external
- testing
- user_ldap
Nextcloud Signing status
No response
Nextcloud Logs
No response
Additional info
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.