From 9792c453657a7222d84a053ca5bf8e32f7565403 Mon Sep 17 00:00:00 2001 From: Roman Perekhod Date: Mon, 16 Sep 2024 09:39:34 +0200 Subject: [PATCH] prevent adding the federated users as members of the space --- changelog/unreleased/fix-ocm-space-sharing.md | 6 ++++++ .../graph/pkg/service/v0/api_driveitem_permissions.go | 8 ++++++++ 2 files changed, 14 insertions(+) create mode 100644 changelog/unreleased/fix-ocm-space-sharing.md diff --git a/changelog/unreleased/fix-ocm-space-sharing.md b/changelog/unreleased/fix-ocm-space-sharing.md new file mode 100644 index 000000000..949198bcb --- /dev/null +++ b/changelog/unreleased/fix-ocm-space-sharing.md @@ -0,0 +1,6 @@ +Bugfix: fix ocm space sharing + +We prevent adding the federated users as members of the space. + +https://github.com/owncloud/ocis/pull/10060 +https://github.com/owncloud/ocis/issues/10051 diff --git a/services/graph/pkg/service/v0/api_driveitem_permissions.go b/services/graph/pkg/service/v0/api_driveitem_permissions.go index 9cdc55772..c76c61abe 100644 --- a/services/graph/pkg/service/v0/api_driveitem_permissions.go +++ b/services/graph/pkg/service/v0/api_driveitem_permissions.go @@ -325,6 +325,14 @@ func (s DriveItemPermissionsService) SpaceRootInvite(ctx context.Context, driveI return libregraph.Permission{}, errorcode.New(errorcode.InvalidRequest, "unsupported space type") } + if s.config.IncludeOCMSharees && len(invite.GetRecipients()) > 0 { + objectID := invite.GetRecipients()[0].GetObjectId() + _, err := s.identityCache.GetAcceptedUser(ctx, objectID) + if err == nil { + return libregraph.Permission{}, errorcode.New(errorcode.NotAllowed, "federated user can not become a space member") + } + } + rootResourceID := space.GetRoot() return s.Invite(ctx, rootResourceID, invite) }