Skip to content

fix(security+nc34): symfony CVEs, \OC::$server accessors, array-shape bug #317

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rubenvdlinde merged 1 commit into from
May 26, 2026
Merged

fix(security+nc34): symfony CVEs, \OC::$server accessors, array-shape bug #317

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
137 changes: 74 additions & 63 deletions composer.lock
View file
Open in desktop

Large diffs are not rendered by default.

10 changes: 7 additions & 3 deletions lib/AppInfo/Application.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,9 @@ function (ContainerInterface $c) {
return new HierarchyHandler(
_organizationHandler: $c->get('OCA\SoftwareCatalog\Service\SoftwareCatalogue\OrganizationHandler'),
_contactPersonHandler: $c->get('OCA\SoftwareCatalog\Service\SoftwareCatalogue\ContactPersonHandler'),
_logger: $c->get(LoggerInterface::class)
_logger: $c->get(LoggerInterface::class),
_userManager: $c->get(IUserManager::class),
_groupManager: $c->get(IGroupManager::class)
);
}
);
Expand Down Expand Up @@ -258,7 +260,8 @@ function ($container) {
request: $container->get('OCP\IRequest'),
container: $container,
appManager: $container->get('OCP\App\IAppManager'),
logger: $container->get('Psr\Log\LoggerInterface')
logger: $container->get('Psr\Log\LoggerInterface'),
groupManager: $container->get(IGroupManager::class)
);
}
);
Expand Down Expand Up @@ -340,7 +343,8 @@ function ($container) {
container: $container,
logger: $container->get('Psr\Log\LoggerInterface'),
settingsService: $container->get(SettingsService::class),
organisationService: $container->get(OpenRegisterOrganisationService::class)
organisationService: $container->get(OpenRegisterOrganisationService::class),
dbConnection: $container->get(IDBConnection::class)
);
}
);
Expand Down
7 changes: 5 additions & 2 deletions lib/Service/ArchiMateImportService.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
use OCA\OpenRegister\Service\ObjectService;
use OCA\OpenRegister\Service\OrganisationService;
use OCP\App\IAppManager;
use OCP\IDBConnection;
use OCP\IAppConfig;
use OCP\IUserSession;
use OCP\Files\IRootFolder;
Expand Down Expand Up @@ -165,6 +166,7 @@ class ArchiMateImportService
* @param LoggerInterface $logger Logger service
* @param SettingsService $settingsService Settings service for AMEF configuration.
* @param OrganisationService $organisationService Organisation service.
* @param IDBConnection $dbConnection Database connection interface.
*/
public function __construct(
private readonly IAppConfig $config,
Expand All @@ -174,7 +176,8 @@ public function __construct(
private readonly ContainerInterface $container,
private readonly LoggerInterface $logger,
private readonly SettingsService $settingsService,
private readonly OrganisationService $organisationService
private readonly OrganisationService $organisationService,
private readonly IDBConnection $dbConnection
) {
}//end __construct()

Expand Down Expand Up @@ -1462,7 +1465,7 @@ private function fixStandaardVersieUuids(int $registerId): void
}

// Get database connection.
$connection = \OC::$server->getDatabaseConnection();
$connection = $this->dbConnection;
$tableName = 'oc_openregister_table_'.$registerId.'_'.$elementSchemaId;

// Step 1: Build a mapping from ArchiMate identifier to database UUID for Standaarden.
Expand Down
1 change: 1 addition & 0 deletions lib/Service/OrganizationSyncService.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2494,6 +2494,7 @@ public function processSpecificContactPerson($contactObject): array
]
);

/** @var array<string, mixed> $contactEntityObject */
$contactEntityObject = $contactObject->getObject();

// Skip if no organization reference.
Expand Down
25 changes: 14 additions & 11 deletions lib/Service/SettingsService.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
namespace OCA\SoftwareCatalog\Service;

use OCP\IAppConfig;
use OCP\IGroupManager;
use OCP\IRequest;
use OCP\App\IAppManager;
use Psr\Container\ContainerInterface;
Expand Down Expand Up @@ -104,18 +105,20 @@ class SettingsService
/**
* SettingsService constructor
*
* @param IAppConfig $config App configuration interface
* @param IRequest $request Request interface
* @param ContainerInterface $container Container for dependency injection
* @param IAppManager $appManager App manager interface
* @param LoggerInterface $logger Logger interface
* @param IAppConfig $config App configuration interface
* @param IRequest $request Request interface
* @param ContainerInterface $container Container for dependency injection
* @param IAppManager $appManager App manager interface
* @param LoggerInterface $logger Logger interface
* @param IGroupManager $groupManager Group manager interface
*/
public function __construct(
private readonly IAppConfig $config,
private readonly IRequest $request,
private readonly ContainerInterface $container,
private readonly IAppManager $appManager,
private readonly LoggerInterface $logger
private readonly LoggerInterface $logger,
private readonly IGroupManager $groupManager
) {
$this->appName = 'softwarecatalog';
}//end __construct()
Expand Down Expand Up @@ -1629,7 +1632,7 @@ public function createAndConfigureUserGroups(): array
];

// Get the group manager.
$groupManager = \OC::$server->getGroupManager();
$groupManager = $this->groupManager;

// Define the required groups (matching role-based system).
$requiredGroups = [
Expand Down Expand Up @@ -1664,7 +1667,7 @@ public function createAndConfigureUserGroups(): array

// Create the group.
$group = $groupManager->createGroup($groupId);
if ($group !== false) {
if ($group !== null) {
$result['created'][] = $groupId;
$this->logger->info("SettingsService: Created user group: {$groupId}");
} else {
Expand Down Expand Up @@ -1750,7 +1753,7 @@ private function createRequiredUserGroups(): void
$this->logger->info('Starting creation of required user groups');

// Get the group manager.
$groupManager = \OC::$server->getGroupManager();
$groupManager = $this->groupManager;

// Define the required groups (matching role-based system).
$requiredGroups = [
Expand Down Expand Up @@ -1788,7 +1791,7 @@ private function createRequiredUserGroups(): void

// Create the group.
$group = $groupManager->createGroup($groupId);
if ($group !== false) {
if ($group !== null) {
$createdGroups[] = $groupId;
$this->logger->info("Created user group: {$groupId}");
} else {
Expand Down Expand Up @@ -1847,7 +1850,7 @@ public function getAllGroups(): array
// Get group manager if possible.
if ($this->appManager->isInstalled('user_management') === true) {
try {
$groupManager = \OC::$server->getGroupManager();
$groupManager = $this->groupManager;
$allGroups = $groupManager->search('');

foreach ($allGroups as $group) {
Expand Down
4 changes: 2 additions & 2 deletions lib/Service/SoftwareCatalogue/ContactPersonHandler.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1593,7 +1593,7 @@ public function setUserManager(string $username, string $managerUsername): void

// In Nextcloud, we can set this as a user preference or custom attribute.
// Since there's no built-in manager field, we'll use preferences.
\OC::$server->getConfig()->setUserValue(
$this->config->setUserValue(
$username,
'softwarecatalog',
'manager',
Expand Down Expand Up @@ -1630,7 +1630,7 @@ public function setUserManager(string $username, string $managerUsername): void
public function getUserManager(string $username): ?string
{
try {
$manager = \OC::$server->getConfig()->getUserValue(
$manager = $this->config->getUserValue(
$username,
'softwarecatalog',
'manager',
Expand Down
12 changes: 9 additions & 3 deletions lib/Service/SoftwareCatalogue/HierarchyHandler.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@

use OCA\SoftwareCatalog\Service\SoftwareCatalogue\OrganizationHandler;
use OCA\SoftwareCatalog\Service\SoftwareCatalogue\ContactPersonHandler;
use OCP\IGroupManager;
use OCP\IUserManager;
use Psr\Log\LoggerInterface;

/**
Expand Down Expand Up @@ -56,11 +58,15 @@ class HierarchyHandler
* @param OrganizationHandler $_organizationHandler Organization handler
* @param ContactPersonHandler $_contactPersonHandler Contact person handler
* @param LoggerInterface $_logger Logger interface
* @param IUserManager $_userManager User manager interface
* @param IGroupManager $_groupManager Group manager interface
*/
public function __construct(
private readonly OrganizationHandler $_organizationHandler,
private readonly ContactPersonHandler $_contactPersonHandler,
private readonly LoggerInterface $_logger,
private readonly IUserManager $_userManager,
private readonly IGroupManager $_groupManager,
) {
}//end __construct()

Expand Down Expand Up @@ -237,7 +243,7 @@ private function findSubordinates(string $username): array

try {
// Get all users and check their managers.
$userManager = \OC::$server->getUserManager();
$userManager = $this->_userManager;
$users = $userManager->search('');

foreach ($users as $user) {
Expand Down Expand Up @@ -271,14 +277,14 @@ private function findSubordinates(string $username): array
private function isUserBeheerder(string $username): bool
{
try {
$groupManager = \OC::$server->getGroupManager();
$groupManager = $this->_groupManager;
$beheerderGroup = $groupManager->get('beheerder');

if ($beheerderGroup === null) {
return false;
}

$userManager = \OC::$server->getUserManager();
$userManager = $this->_userManager;
$user = $userManager->get($username);

if ($user === null) {
Expand Down
19 changes: 14 additions & 5 deletions lib/Service/SoftwareCatalogueService.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@
use Psr\Log\LoggerInterface;
use Psr\Container\ContainerInterface;
use OCP\App\IAppManager;
use OCP\IGroupManager;
use OCP\IUserManager;
use OCP\IUserSession;

/**
* Service for handling software catalog operations.
Expand Down Expand Up @@ -83,6 +86,9 @@ class SoftwareCatalogueService
* @param LoggerInterface $_logger Logger interface.
* @param ContainerInterface $_container Container interface.
* @param IAppManager $_appManager App manager interface.
* @param IUserSession $_userSession User session interface.
* @param IUserManager $_userManager User manager interface.
* @param IGroupManager $_groupManager Group manager interface.
*/
public function __construct(
private readonly OrganizationHandler $_organizationHandler,
Expand All @@ -93,6 +99,9 @@ public function __construct(
private readonly LoggerInterface $_logger,
private readonly ContainerInterface $_container,
private readonly IAppManager $_appManager,
private readonly IUserSession $_userSession,
private readonly IUserManager $_userManager,
private readonly IGroupManager $_groupManager,
) {
$this->appName = 'softwarecatalog';
}//end __construct()
Expand Down Expand Up @@ -1538,7 +1547,7 @@ private function createOrganisationInOpenRegisterInternal(
);

// Check if we're in an anonymous context (no logged-in user).
$userSession = \OC::$server->getUserSession();
$userSession = $this->_userSession;
$currentUser = $userSession->getUser();

$currentUserValue = 'null';
Expand Down Expand Up @@ -2253,7 +2262,7 @@ private function activateSoftwareCatalogUsersForOrganization(string $organizatio
);

// Get the user manager.
$userManager = \OC::$server->getUserManager();
$userManager = $this->_userManager;
$activatedUsers = [];
$failedUsers = [];

Expand Down Expand Up @@ -2362,7 +2371,7 @@ private function deactivateSoftwareCatalogUsersForOrganization(string $organizat
);

// Get the user manager.
$userManager = \OC::$server->getUserManager();
$userManager = $this->_userManager;
$deactivatedUsers = [];
$failedUsers = [];

Expand Down Expand Up @@ -2526,7 +2535,7 @@ private function getSoftwareCatalogUsersForOrganization(string $organizationUuid
private function getAdminGroupUsernames(): array
{
try {
$groupManager = \OC::$server->getGroupManager();
$groupManager = $this->_groupManager;
$adminGroup = $groupManager->get('admin');

if ($adminGroup === null) {
Expand Down Expand Up @@ -2579,7 +2588,7 @@ private function addAdminGroupUsersToOrganization(string $organizationUuid): voi
);

// Get the group manager to access admin group users.
$groupManager = \OC::$server->getGroupManager();
$groupManager = $this->_groupManager;
$adminGroup = $groupManager->get('admin');

if ($adminGroup === null) {
Expand Down