Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[IMAP] login without domain is alowed and creates new users

Aperta
  • Qualcosa non va?
#128 13 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
php
Ambito
authentication, backend

Direzione di ricerca

Start by reproducing the behavior with the shown OC_User_IMAP configuration, especially with domain stripping disabled. Compare authentication for [email protected] and user, and verify the resulting Nextcloud UIDs and external-account records. Done means a domainless login is rejected when the IMAP server rejects it and no unintended user is created.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

1. to develop bug
Steps to reproduce
  1. setup nextcloud and configure user_external as further below (especially with false for domain stripping).
  2. login as [email protected] and everything seems to work as it should: new users get automatically created with uid [email protected].
    also the tables users_external, accounts and credentials seem fine...
  3. now try to login as user with the same (correct) password: then a new user with uid user gets created and seems to work like a normal nextcloud-user, although a login without the domain does not work at the plain IMAP-server! 😲
  4. first i thought this issue occurres because this instance has accidentally created new users without domain while migrating from user_external <0.6.0.
    but i've deleted them all and this bug seems to "work" also for completely new users.
Expected behaviour

user_external should IMHO not add the domain for authentication and even more important not strip it for the nextcloud uid especially if it is configured to have uids with domain!
in best case this creates confusion or panic at the users and is just annoying for admins... but in the worst case with more than one user_backends resp. domain, this creates a hell of a mess and serious trouble!

Actual behaviour

see Steps to reproduce

Affected Authentication backend

at least IMAP (i don't use other)

Server configuration

User External App version: (see Nextcloud apps page)
0.8.0

Operating system:
ubuntu

Web server:
apache

Database:
mysql 5.7.28

PHP version:
7.2.24

Nextcloud version: (see Nextcloud admin page)
16.0.8.1

Updated from an older Nextcloud/ownCloud or fresh install:
updated from at least NC13

Where did you install Nextcloud from:
hoster script

Signing status:

Signing status 
No errors have been found.

List of activated apps:

App list 
quite a bunch, but IMHO in this case irrelevant.

Nextcloud configuration:

Config report 
...
  'user_backends' => 
  array (
    0 => 
    array (
      'class' => 'OC_User_IMAP',
      'arguments' => 
      array (
        0 => 'mail.server.tld',
        1 => 993,
        2 => 'ssl',
        3 => 'domain.tld',
        4 => false,
        5 => false,
      ),
    ),
  ),
...
Logs
Web server error log
Web server error log 
nothing regarding this issue
Nextcloud log (data/nextcloud.log)
Nextcloud log 
nothing regarding this issue
Browser log
Browser log 
nothing regarding this issue
Lingua principale
JavaScript
Stelle
121
Fork
73
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextcloud/user_external

Tutte le issue di nextcloud/user_external

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.