Privacy - Auto-Complete with emails from the instance

[pierreozoux]

I run a shared instance.
when people put an email in the "to" field, they get suggestion from the full instance.

I think it might good to have a parameter that would deactivate this feature.
(This is currently a privacy issue for me)

As reported here:
https://forum.indie.host/t/question-about-the-webmail/172

[ChristophWurst]

This should definitely not happen. The intention is that a user sees only addresses they have used themselves. Nothing should be shared there.

mail/lib/db/collectedaddressmapper.php

Lines 44 to 51 in 0abf6d3

	public function findMatching($userId, $query) {
	$sql = 'SELECT * FROM *PREFIX*mail_collected_addresses WHERE `user_id` = ? AND `email` ILIKE ?';
	$params = [
	$userId,
	'%' . $query . '%',
	];
	return $this->findEntities($sql, $params);
	}

should scope the search to only find addresses that belong to the current user.

[ChristophWurst]

On a second thought, do you know where the a auto-completed recipient came from? Was it a collected address from the DB, or maybe take from the contacts integration?
I've tried with collected addresses and could not reproduce the described problem.

[ChristophWurst]

Ping? :-)

[pierreozoux]

Thanks to keep an eye on this (sorry I was out of time..).
It is from the full database of users.

But I could actually reproduce the "bug" (Or misconfiguration) from the "files" app. When I hit share, it proposes me the full database too.

There is definetely something funny with my configuration, and not necessarly the mail app.

[ChristophWurst]

But I could actually reproduce the "bug" (Or misconfiguration) from the "files" app. When I hit share, it proposes me the full database too.

Could you please file an issue at https://github.com/nextcloud/server/issues/new?

There is definetely something funny with my configuration, and not necessarly the mail app.

Could you maybe try to reproduce this bug on a fresh installation? I was unable to reproduce this here.

[HeikoBei]

I have the same problem, but only in the email app.
It seems that the mail client searches in the "accounts"-table as well as in the 'mail_collected_adresses' table.

That's bad because there are users on my system who must not see each other.

I checked it in NC 11.03, mail version 0.6.4 and did a quick check on a newly installed NC 12 same mail version, the result was the same.
Is there a way to search only the table mail_collected_addresses and not include the system accounts ?
Thanks in advance

[ChristophWurst]

@HeikoBei sounds like what I've fixed in nextcloud/server#4757 (the contacts menu uses the same data source as the auto completion here).