diff options
author | John Molakvoæ <skjnldsv@users.noreply.github.com> | 2020-09-14 09:14:40 +0300 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-09-14 09:14:40 +0300 |
commit | 8e22c9094623a9167f02f90639be20edc8dc607f (patch) | |
tree | b080c0fe6736ef9f393eb3c045fa71c45a63cbfe | |
parent | 3ffd09d3f191def63ad2766368aaef62b333fcd1 (diff) | |
parent | b5204a78ccd5d8a00e0ac3d7c0e6d1ab5ad5bfe8 (diff) |
Merge pull request #22770 from nextcloud/bugfix/noid/urldecode_principal_uri
-rw-r--r-- | apps/dav/lib/Connector/Sabre/Principal.php | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/apps/dav/lib/Connector/Sabre/Principal.php b/apps/dav/lib/Connector/Sabre/Principal.php index cfe9a6d7f73..1ddbc1a6083 100644 --- a/apps/dav/lib/Connector/Sabre/Principal.php +++ b/apps/dav/lib/Connector/Sabre/Principal.php @@ -168,7 +168,11 @@ class Principal implements BackendInterface { } if ($prefix === $this->principalPrefix) { - $user = $this->userManager->get($name); + // Depending on where it is called, it may happen that this function + // is called either with a urlencoded version of the name or with a non-urlencoded one. + // The urldecode function replaces %## and +, both of which are forbidden in usernames. + // Hence there can be no ambiguity here and it is safe to call urldecode on all usernames + $user = $this->userManager->get(urldecode($name)); if ($user !== null) { return $this->userToPrincipal($user); |