Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable23] Fix get avatar authorization #32771

Merged
merged 2 commits into from
Jun 9, 2022
Merged

[stable23] Fix get avatar authorization #32771

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e6e5e08
Fix get avatar authorization
Pytal Jun 2, 2022
4e04f4e
Test all scopes
Pytal Jun 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 14 additions & 11 deletions lib/private/Avatar/AvatarManager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,20 +135,23 @@ public function getAvatar(string $userId) : IAvatar {
$avatarScope = '';
}

if (
switch ($avatarScope) {
// v2-private scope hides the avatar from public access and from unknown users
$avatarScope === IAccountManager::SCOPE_PRIVATE
&& (
// accessing from public link
$requestingUser === null
// logged in, but unknown to user
|| !$this->knownUserService->isKnownToUser($requestingUser->getUID(), $userId)
)) {
// use a placeholder avatar which caches the generated images
return new PlaceholderAvatar($folder, $user, $this->logger);
case IAccountManager::SCOPE_PRIVATE:
if ($requestingUser !== null && $this->knownUserService->isKnownToUser($requestingUser->getUID(), $userId)) {
return new UserAvatar($folder, $this->l, $user, $this->logger, $this->config);
}
break;
case IAccountManager::SCOPE_LOCAL:
case IAccountManager::SCOPE_FEDERATED:
case IAccountManager::SCOPE_PUBLISHED:
return new UserAvatar($folder, $this->l, $user, $this->logger, $this->config);
default:
// use a placeholder avatar which caches the generated images
return new PlaceholderAvatar($folder, $user, $this->logger);
}

return new UserAvatar($folder, $this->l, $user, $this->logger, $this->config);
return new PlaceholderAvatar($folder, $user, $this->logger);
}

/**
Expand Down
33 changes: 28 additions & 5 deletions tests/lib/Avatar/AvatarManagerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,33 +161,56 @@ public function testGetAvatarValidUserDifferentCasing() {
->method('getUID')
->willReturn('valid-user');

$this->userSession->expects($this->once())
->method('getUser')
->willReturn($user);

$folder = $this->createMock(ISimpleFolder::class);
$this->appData
->expects($this->once())
->method('getFolder')
->with('valid-user')
->willReturn($folder);

$account = $this->createMock(IAccount::class);
$this->accountManager->expects($this->once())
->method('getAccount')
->with($user)
->willReturn($account);

$property = $this->createMock(IAccountProperty::class);
$account->expects($this->once())
->method('getProperty')
->with(IAccountManager::PROPERTY_AVATAR)
->willReturn($property);

$property->expects($this->once())
->method('getScope')
->willReturn(IAccountManager::SCOPE_FEDERATED);

$expected = new UserAvatar($folder, $this->l10n, $user, $this->logger, $this->config);
$this->assertEquals($expected, $this->avatarManager->getAvatar('vaLid-USER'));
}

public function knownUnknownProvider() {
public function dataGetAvatarScopes() {
return [
[IAccountManager::SCOPE_LOCAL, false, false, false],
[IAccountManager::SCOPE_LOCAL, true, false, false],

// public access cannot see real avatar
[IAccountManager::SCOPE_PRIVATE, true, false, true],
// unknown users cannot see real avatar
[IAccountManager::SCOPE_PRIVATE, false, false, true],
// known users can see real avatar
[IAccountManager::SCOPE_PRIVATE, false, true, false],
[IAccountManager::SCOPE_LOCAL, false, false, false],
[IAccountManager::SCOPE_LOCAL, true, false, false],
[IAccountManager::SCOPE_FEDERATED, false, false, false],
[IAccountManager::SCOPE_FEDERATED, true, false, false],
[IAccountManager::SCOPE_PUBLISHED, false, false, false],
[IAccountManager::SCOPE_PUBLISHED, true, false, false],
];
}

/**
* @dataProvider knownUnknownProvider
* @dataProvider dataGetAvatarScopes
*/
public function testGetAvatarScopes($avatarScope, $isPublicCall, $isKnownUser, $expectedPlaceholder) {
if ($isPublicCall) {
Expand Down