Skip to content

fix(mail): send internal link#2390

Merged
sorbaugh merged 1 commit intomasterfrom
fix/noid/internal-link
Apr 15, 2026
Merged

fix(mail): send internal link#2390
sorbaugh merged 1 commit intomasterfrom
fix/noid/internal-link

Conversation

@ArtificialOwl
Copy link
Copy Markdown
Member

@ArtificialOwl ArtificialOwl commented Mar 12, 2026

generate an internal link instead of public link when sending mail to local account

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
@ArtificialOwl ArtificialOwl force-pushed the fix/noid/internal-link branch from a222c8a to fb7a3d7 Compare March 12, 2026 13:41
@ArtificialOwl
Copy link
Copy Markdown
Member Author

/backport to stable33

@ArtificialOwl
Copy link
Copy Markdown
Member Author

/backport to stable32

@T0mWz
Copy link
Copy Markdown

T0mWz commented Apr 10, 2026

@ArtificialOwl , I wonder if this change is sufficient, as I think that still a public link token is generated, although this is not actively communicated to the user. https://github.com/nextcloud/circles/blob/master/lib/ShareByCircleProvider.php#L145

This change does not, in fact, resolve the underlying problem. Namely that a shareToken is generated, but it is only not mailed. This means the vulnerability remains, allowing unauthorised access to the data if the correct URL is guessed

-		$share->setToken($this->token(15));
+		$share->setToken('');

@sorbaugh sorbaugh merged commit 4a2601d into master Apr 15, 2026
43 of 44 checks passed
@sorbaugh sorbaugh deleted the fix/noid/internal-link branch April 15, 2026 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants