fix(sharing): properly frame block list

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Author: susnux

apps/settings/src/components/AdminSettingsSharingForm.vue

@@ -115,15 +115,15 @@
 					value="yes"
 					type="radio"
 					@update:modelValue="onUpdateExcludeGroups">
-					{{ t('settings', 'Exclude some groups') }}
+					{{ t('settings', 'Exclude some groups (block list)') }}
 				</NcCheckboxRadioSwitch>
 				<NcCheckboxRadioSwitch
 					v-model="settings.excludeGroups"
 					name="excludeGroups"
 					value="allow"
 					type="radio"
 					@update:modelValue="onUpdateExcludeGroups">
-					{{ t('settings', 'Allow some groups') }}
+					{{ t('settings', 'Allow some groups only (allow list)') }}
 				</NcCheckboxRadioSwitch>
 				<div v-show="settings.excludeGroups !== 'no'" class="sharing__labeled-entry sharing__input">
 					<NcSettingsSelectGroup
@@ -133,7 +133,15 @@
 						:label="settings.excludeGroups === 'allow' ? t('settings', 'Groups allowed to share') : t('settings', 'Groups excluded from sharing')"
 						:disabled="settings.excludeGroups === 'no'"
 						style="width: 100%" />
-					<em id="settings-sharing-excluded-groups-desc">{{ t('settings', 'Not allowed groups will still be able to receive shares, but not to initiate them.') }}</em>
+					<em id="settings-sharing-excluded-groups-desc">
+						<template v-if="settings.excludeGroups === 'allow'">
+							{{ t('settings', 'Only members of at least one of this groups will be able to initiate shares.') }}
+							{{ t('settings', 'Others will be blocked, but are still able to receive shares.') }}
+						</template>
+						<template v-else>
+							{{ t('settings', 'A member of at least least one of this groups will not be able to initiate new shares, but will still be able to receive shares.') }}
+						</template>
+					</em>
 				</div>
 			</div>
 

lib/private/Contacts/ContactsMenu/ContactsStore.php

@@ -9,6 +9,7 @@
 
 use OC\KnownUser\KnownUserService;
 use OC\Profile\ProfileManager;
+use OC\Share20\ShareDisableChecker;
 use OCA\UserStatus\Db\UserStatus;
 use OCA\UserStatus\Service\StatusService;
 use OCP\Contacts\ContactsMenu\IContactsStore;
@@ -38,6 +39,7 @@ public function __construct(
 		private IGroupManager $groupManager,
 		private KnownUserService $knownUserService,
 		private IL10NFactory $l10nFactory,
+		private ShareDisableChecker $shareDisableChecker,
 	) {
 	}
 
@@ -173,31 +175,11 @@ private function filterContacts(
 		$excludeGroups = $this->config->getAppValue('core', 'shareapi_exclude_groups', 'no');
 
 		// whether to filter out local users
-		$skipLocal = false;
+		$skipLocal = $this->shareDisableChecker->sharingDisabledForUser($self->getUID());
 		// whether to filter out all users which don't have a common group as the current user
 		$ownGroupsOnly = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members', 'no') === 'yes';
 
 		$selfGroups = $this->groupManager->getUserGroupIds($self);
-
-		if ($excludeGroups && $excludeGroups !== 'no') {
-			$excludedGroups = $this->config->getAppValue('core', 'shareapi_exclude_groups_list', '');
-			$decodedExcludeGroups = json_decode($excludedGroups, true);
-			$excludeGroupsList = $decodedExcludeGroups ?? [];
-
-			if ($excludeGroups !== 'allow') {
-				if (count($selfGroups) > 0 && count(array_diff($selfGroups, $excludeGroupsList)) === 0) {
-					// all the groups of the current user are excluded -> filter all local users
-					$skipLocal = true;
-				}
-			} else {
-				$skipLocal = true;
-				if (count(array_intersect($excludeGroupsList, $selfGroups)) !== 0) {
-					// a group of the current user is allowed -> do not filter all local users
-					$skipLocal = false;
-				}
-			}
-		}
-
 		// ownGroupsOnly : some groups may be excluded
 		if ($ownGroupsOnly) {
 			$excludeGroupsFromOwnGroups = $this->config->getAppValue('core', 'shareapi_only_share_with_group_members_exclude_group_list', '');

lib/private/Share20/ShareDisableChecker.php

@@ -50,29 +50,17 @@ public function sharingDisabledForUser(?string $userId): bool {
 				return false;
 			}
 			$usersGroups = $this->groupManager->getUserGroupIds($user);
-			if ($excludeGroups !== 'allow') {
-				if (!empty($usersGroups)) {
-					$remainingGroups = array_diff($usersGroups, $excludedGroups);
-					// if the user is only in groups which are disabled for sharing then
-					// sharing is also disabled for the user
-					if (empty($remainingGroups)) {
-						$this->sharingDisabledForUsersCache[$userId] = true;
-						return true;
-					}
-				}
-			} else {
-				if (!empty($usersGroups)) {
-					$remainingGroups = array_intersect($usersGroups, $excludedGroups);
-					// if the user is in any group which is allowed for sharing then
-					// sharing is also allowed for the user
-					if (!empty($remainingGroups)) {
-						$this->sharingDisabledForUsersCache[$userId] = false;
-						return false;
-					}
-				}
-				$this->sharingDisabledForUsersCache[$userId] = true;
-				return true;
-			}
+			$intersectingGroups = array_intersect($usersGroups, $excludedGroups);
+
+			// 1. If the user is in a group which is disabled for sharing then
+			//    sharing is also disabled for the user.
+			// 2. If the user is in a group which is allowed for sharing then
+			//    sharing is also allowed for the user.
+			$isInList = $intersectingGroups !== [];
+			$isBlockList = $excludeGroups !== 'allow';
+			$sharingDisabled = $isBlockList ? $isInList : !$isInList;
+			$this->sharingDisabledForUsersCache[$userId] = $sharingDisabled;
+			return $sharingDisabled;
 		}
 
 		$this->sharingDisabledForUsersCache[$userId] = false;