Share link leaks owner user id and displayname

[Wikinaut]

In the Webpage source code, I found data which should not be present when a nextcloud directory or file is shared via a shared link:

data-owner-display-name="John Doe" data-owner="John Doe" data-name="thisDirectory"

When sharing parts of a Nextcloud data area, Nextcloud should never leak any internal information.

[sphrak]

Can confirm this issue aswell on 12.0.3. Agree this should not be shared.

[MorrisJobke]

This is also shown on the public share page and by intention to personalise and give the recipient context.

[Wikinaut]

I do no think, that a secure tool like Nextcloud should reveal the owner names to everyone whom you sent (or publish elsewhere) a shared link.

I wish a public discussion about this issue.

[MorrisJobke]

cc @nextcloud/designers @rullzer @nickvergessen @LukasReschke @schiessle @karlitschek What do you think about this?

I tend to say, that if you share something with somebody the other person should see that this is from me and give the recipient this context. If you don't want that to be exposed, then use a password protected share or don't enter you real name into Nextcloud.

[skjnldsv]

I agree that leaking the username is a security flaw. Display the real name would be fine. Reveal nothing is best. Why do we have those info here?

[Wikinaut]

@MorrisJobke When you post a shared link on for example Twitter, you don't want tell the world your real name. I would really like to see a broader discussion here. It was a good idea to fork from owncloud, and now we can listen to users and developers, please keep listening to the users.

@LukasReschke Please state your view as a security-aware person. I personally regard it as an #epicfail if internal data can be seen on a shared-link webpage.

[nickvergessen]

Just for the record, if at all this is a privacy issue, not a security issue.

But then again, you got the link from that person or another one. Why should the name be a secret?

Showing the name was added by morris, reviewed by lukas, so I guess opinions are good:
#5827

Let me quote:

I talked with @LukasReschke about this and he said, that this would be a nice way to avoid phishing attacks.

[skjnldsv]

Hum, the username isn't really leaked. It's just that a new user have its Full name set to its username by default (until changed by the user itself).