From 7facae6b83291e8948a177f1b8a07e26e577c1cd Mon Sep 17 00:00:00 2001 From: Daniel Kesselberg Date: Tue, 27 Aug 2024 11:31:54 +0200 Subject: [PATCH] fix: remove caching in fetchListOfGroups When using nested groups without a memberof overlay, then fetchListOfGroups is called from getGroupsByMember without applying the group filter. In some setups, the "unfiltered" result is then written back to the group mapping table. That might cause random "An administrator removed you from group" activities. I was unable to replicate it locally, but we got the feedback that the random activities stopped with the patch applied. Ref: https://github.com/nextcloud/server/issues/42195 Signed-off-by: Daniel Kesselberg --- apps/user_ldap/lib/Access.php | 16 ---------------- apps/user_ldap/tests/AccessTest.php | 2 +- 2 files changed, 1 insertion(+), 17 deletions(-) diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index 77679ccc948..ff9ed6d7747 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -958,22 +958,6 @@ class Access extends LDAPUtility { } $groupRecords = $this->searchGroups($filter, $attr, $limit, $offset); - $listOfDNs = array_reduce($groupRecords, function ($listOfDNs, $entry) { - $listOfDNs[] = $entry['dn'][0]; - return $listOfDNs; - }, []); - $idsByDn = $this->getGroupMapper()->getListOfIdsByDn($listOfDNs); - - array_walk($groupRecords, function (array $record) use ($idsByDn): void { - $newlyMapped = false; - $gid = $idsByDn[$record['dn'][0]] ?? null; - if ($gid === null) { - $gid = $this->dn2ocname($record['dn'][0], null, false, $newlyMapped, $record); - } - if (!$newlyMapped && is_string($gid)) { - $this->cacheGroupExists($gid); - } - }); $listOfGroups = $this->fetchList($groupRecords, $this->manyAttributes($attr)); $this->connection->writeToCache($cacheKey, $listOfGroups); return $listOfGroups; diff --git a/apps/user_ldap/tests/AccessTest.php b/apps/user_ldap/tests/AccessTest.php index 5b824a89e96..dba6e5480d5 100644 --- a/apps/user_ldap/tests/AccessTest.php +++ b/apps/user_ldap/tests/AccessTest.php @@ -667,7 +667,7 @@ class AccessTest extends TestCase { $this->groupMapper->expects($this->never()) ->method('getNameByDN'); - $this->connection->expects($this->exactly(3)) + $this->connection->expects($this->exactly(1)) ->method('writeToCache'); $groups = $this->access->fetchListOfGroups($filter, $attributes);