nextcloud / lookup-server

:eyes: Lookup server to find remote users for federated sharing
23 stars 16 forks source link

Lookup server matches email as well as userid #75

Closed mickenordin closed 1 year ago

mickenordin commented 2 years ago

When there are several users accounts that share the same email address AND the userid for one of those accounts is the same as the email address, the lookup server will pick a user at random from those accounts that share email address, causing the user to be logged in to a random server.

The fix for this is to only search for the username in the store where the key is "userid" like this:

diff --git a/server/lib/UserManager.php b/server/lib/UserManager.php
index 9739ee0..c605432 100644
--- a/server/lib/UserManager.php
+++ b/server/lib/UserManager.php
@@ -150,7 +150,7 @@ FROM (
        WHERE userId IN (
                SELECT DISTINCT userId
                FROM `store`
-               WHERE v ' . $operator . ' :search ' . $constraint .'
+               WHERE v ' . $operator . ' :search ' . $constraint .' AND k = "userid"
        )
        GROUP BY userId
 ) AS tmp

I will submit a PR with this proposed fix shortly.