nextcloud / circles

👪 Create groups with other users on a Nextcloud instance and share with them
GNU Affero General Public License v3.0
141 stars 47 forks source link

Circle ownership can be assigned to non-acting user/invalid email address #1619

Open keunes opened 1 week ago

keunes commented 1 week ago

Hello,

I experienced the following issue/bug (there's no template so I'm hoping I'm providing all relevant information here):

Steps to reproduce

  1. On https://framagenda.org, create an account and create a circle
  2. On your own Nextcloud instance (e.g. https://cloud.keunes.com), figure out your federated ID: keunes@cloud.keunes.com
  3. On framagenda.org, open the created circle and click 'Add members'
  4. Enter the federated ID: keunes@cloud.keunes.com and click on the button "Add to [circle name]"
  5. Click on the three dots of the added account/member and then 'Promote to owner)

The problem The federated user ID seems to be interpreted as an email address. (I'm not sure if federated users can be added to circles.) However, it is not a valid email address and cannot receive emails with invites. At this point, the account that cannot be accessed is marked as owner. The circle can no longer be deleted by anyone (but the admins, I suppose).

Proposed solution Only allow ownership to be assigned to users on the instance of the circle and to federated users, not to email accounts.