Skip to content

Calendar invitation autocomplete ignores global "shareapi" and privacy restrictions #8726

Description

@PPGCoding

Steps to reproduce

Go to Administration settings -> Sharing.
Under "Limit sharing based on groups", select "Allow some groups" and restrict it to a specific group (e.g., "admin").
Under "Privacy settings for sharing", enable "Allow autocompletion to full match when entering the full name...".
Ensure that only "Also allow autocompletion on full match of the user email" is checked, while other full-match options (like User ID or Display name) are disabled.
Log in as a normal user who is NOT part of the allowed "admin" group.
Open the Calendar app, create a new event, and type single characters or letters into the "Attendees" search field.

Image

Expected behavior

The autocomplete should NOT show any users or email addresses, because sharing is restricted to admins, and incomplete matches are forbidden. This works perfectly in the Files app.

Actual behavior

The Calendar search field completely ignores these administrative restrictions. It queries the global user database and exposes full names and email addresses to unauthorized users immediately upon typing single characters.

Calendar app version

6.5.3

CalDAV-clients used

No response

Browser

Firefox 153.0.3

Client operating system

Windows 11

Server operating system

No response

Web server

None

Database engine version

None

PHP engine version

None

Nextcloud version

34.0.2

Updated from an older installed version or fresh install

None

List of activated apps


Nextcloud configuration


Web server error log


Log file


Browser log


Additional info

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions