nextcloud / nextcloud/text

Profile picture is shown in public links

Open
#5,372 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
659
Forks
133
Avg merge
1d 20h
Merged PRs (30d)
110

Description

Describe the bug
When you share a md-file with a public link and a user who has set it's profile picture to be shown to logged in users only the profile picture is shown publicly while the user edit's the text.

To Reproduce
Steps to reproduce the behavior:

  1. Share an md-file within a collective with a public link.
  2. goto …/index.php/settings/user and set „show to logged in users only“ for Profile Picture
  3. Edit the shared md-file
  4. See profile picture appearing when using the public link

Expected behavior
Profile picture is not shown in public.

Screenshots
If applicable, add screenshots to help explain your problem.

Server details:

  • Nextcloud version: 27.1.6
  • PHP Version: 8.1.27
  • Database: mysql 10.5.22

Client details:

  • OS: macOS 14.3.1
  • Browser: Firefox 122.0.1 logged in as user & Safari 17.3.1 not logged in for opening public link
  • Device: MacBook Pro
Logs
Nextcloud log (data/nextcloud.log)
Insert your Nextcloud log here
Browser log
Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the public-link editing flow described in the issue, using the listed Nextcloud, PHP, database, browser, and client details. Trace how the editor renders the author's profile picture and compare that behavior with the user's “logged in users only” setting; done means the picture is not exposed through the public link.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.