nextcloud / nextcloud/talk-android

Guests can start new conversations ad libitum

Open
#1,720 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

1. to develop approved bug
Dominant language
Kotlin
Stars
739
Forks
321
Avg merge
14h 59m
Merged PRs (30d)
151

Description

I realized that despite having only a limited guest account, users can start any desired conversation (such as public ones, or one-to-one conversations with any user on the server) via the Android Talk app (13.0.0 RC1 via GPlay Beta)

Steps to reproduce

  1. Log into server with a guest account
  2. Click on "+" to start new conversation, select what you would like to do
  3. Create conversations ad libitum
Expected behaviour

Guest accounts should have the same restrictions in the Android app as in the server app - but judging from the possibility to create any conversation desired, this is also linked to the Talk server API that doesn't prevent this?

Actual behaviour

Guests can start any conversation the want, including one-to-one with full search capabilities among all server users.

Device information

Device: Google Pixel 4
Android version: 12

Talk version: 13.0.0

Server information

Nextcloud version: 23 RC

Talk version: 13

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the guest-account flow in the Android Talk app and inspect the conversation-creation path and the Talk server API involved. Compare guest permissions with the server app's restrictions; done means guests cannot create unrestricted conversations or search and message arbitrary users.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
api, authorization, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.