nextcloud / nextcloud/talk-android
Guests can start new conversations ad libitum
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 739
- Forks
- 321
- Avg merge
- 14h 59m
- Merged PRs (30d)
- 151
Description
I realized that despite having only a limited guest account, users can start any desired conversation (such as public ones, or one-to-one conversations with any user on the server) via the Android Talk app (13.0.0 RC1 via GPlay Beta)
Steps to reproduce
- Log into server with a guest account
- Click on "+" to start new conversation, select what you would like to do
- Create conversations ad libitum
Expected behaviour
Guest accounts should have the same restrictions in the Android app as in the server app - but judging from the possibility to create any conversation desired, this is also linked to the Talk server API that doesn't prevent this?
Actual behaviour
Guests can start any conversation the want, including one-to-one with full search capabilities among all server users.
Device information
Device: Google Pixel 4
Android version: 12
Talk version: 13.0.0
Server information
Nextcloud version: 23 RC
Talk version: 13
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the guest-account flow in the Android Talk app and inspect the conversation-creation path and the Talk server API involved. Compare guest permissions with the server app's restrictions; done means guests cannot create unrestricted conversations or search and message arbitrary users.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- api, authorization, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100