Repository navigation
fix(acl): do not double-encode the search query in the sharing sidebar - #5146
Open
mckeydonelly wants to merge 1 commit into
Open
mckeydonelly wants to merge 1 commit into
mckeydonelly wants to merge 1 commit into
Conversation
generateUrl() already URL-encodes its parameters, so wrapping the query in encodeURIComponent() encoded it twice. The server then searched for the literal percent-encoded string, so any query containing non-ASCII characters or a space returned no results. Signed-off-by: Alexey Orlov <mckeydonelly@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
In the "Advanced permissions for Team folder" section of the sharing sidebar, searching for a user, group or team returns "No results" as soon as the query contains a non-ASCII character or a space.
searchMappings()wraps the query inencodeURIComponent()and then passes it togenerateUrl(), which encodes its parameters again. The server receives the literal percent-encoded string and matches nothing:Максsearch=%25D0%259C%25D0%25B0%25D0%25BA%25D1%2581search=%D0%9C%D0%B0%D0%BA%D1%81John Smithsearch=John%2520Smithsearch=John%20SmithJohnsearch=Johnsearch=JohnPlain single-word ASCII queries are unaffected, which is why this is easy to miss. The matching entry also flashes briefly before disappearing, because the select filters the already loaded options client-side until the empty server response replaces them.
The fix drops the extra
encodeURIComponent()call.How to test
Максим Ригосик) to that groupBefore: "No results". After: the user is listed.
Tested on Nextcloud 33.0.9 with groupfolders 21.0.15, where the same code is shipped. A backport to
stable33would be appreciated.🤖 AI (if applicable)