Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[QA] [email protected] can be created, when example.com is in the blocklist #541

Open
jnweiger opened this issue Dec 9, 2022 · 4 comments

Comments

@jnweiger
Copy link
Contributor

jnweiger commented Dec 9, 2022

Seen with guests-0.12.2-rc.1 on server 10.11.0

  • occ app:enable guests
  • Go to Settings -> Admin -> Sharing -> Guests section has an input field blocked domains
  • enter example.com into the blocklist, click in empty space, saved appears.
  • Back to files view, open sharing dialog on the Documents folder
  • enter [email protected] one popups appear for federation only. OK
  • enter [email protected] two popups appear, one for federation, one for sharing. BAD

image

Expected behaviour:

  • subdomains are blocked when parent domain is blocked.
This was referenced Dec 9, 2022
@jnweiger
Copy link
Contributor Author

@enbrnz is this the behaviour, you wanted to implement with #529 ?

@phil-davis
Copy link
Contributor

It seems sensible to me, that blocking "somedomain.co.uk" should block that whole domain, including any sub-domains. (which is the behavior that @jnweiger was expecting to see)

It needs someone to define what is the required behavior. Then we can implement test cases and adjust the code.

@enbrnz
Copy link
Contributor

enbrnz commented Dec 15, 2022

There are arguments for both subdomain blocking or not.
I wasn't aware that subdomain blocking is expected. I did not account for it and implemented what I meant to implement, blocking just the domains on the list.

@jnweiger
Copy link
Contributor Author

jnweiger commented Dec 15, 2022

@enbrnz I have my private opinions what I expect and not. :-)

I have no clear view, what we officially want or what customers expect.
My logic was: with the suffix match that we had before, subdomain blocking was implicit. Maybe the suffix match was initially implemented exactly to catch subdomains? -- Not sure. To be safe and backwards compatible, I am suggesting to have subdomain blocking. Simple consistency argument only.

Regarding arguments for and against: Maybe introduce a different syntax to offer both behaviors: E.g.

  • @example.com blocks only example.com and
  • example.com includes subdomains.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants