cbox share manager lists group shares for users named like the group (and vice versa)

[aduffeck]

I'm not sure how the cbox sql share manager is being used and I didn't actually verify my suspicion, but I believe the share manager doesn't properly distinguish between user and group shares when querying the received shares in https://github.com/cs3org/reva/blob/master/pkg/cbox/share/sql/sql.go#L331.
Looking at the query the share manager seems to return group shares to a user with the same name as the group even if the user is not part of the group and vice versa.

I'm not sure about the practical implications but it does look like a bug to me.

[labkode]

Hi @aduffeck, the SQL query for groups works as follow.

Imagine you (@aduffeck) are part of 3 groups (admins, devs and managers).

When querying the list of received shares we prepare the following SQL condition:

share_with=aduffeck AND share_with in ('admins', 'devs', 'managers')

I hope that answers your question.

[aduffeck]

@labkode the problem I was trying to highlight was that a if a user manages to sign up with the username "managers" they would see the "mangers" group share in their list of shares because the query compares the share_with field with both the username and the group names without taking the share type into account.
Does that make sense?

[ishank011]

Hi @aduffeck, thanks for pointing that out! It indeed is a bug. I'll modify the SQL query to check share_type as well along with share_with.