Fixed username and domain separation in getACL

[Snafu]

Inspired by anikrooz commit
1f95f9b

Addresses issue mentioned here: #26457 (comment)

Signed-off-by: Christopher Gabriel stuff@c-gabriel.at

[Snafu]

I want to point out the comment by anikrooz in the commit that inspired my fix and for some reason I did not pay enough attention to:
"Returning a plain username eg. ['', $user] could be a security risk or at least would be incorrect".
I'm not an expert regarding ACL security, if the above statement is true, then the original fix should be implemented, returning an empty username.

Edit: If that is a security issue it could be possible that the following reolves any security concerns:
...
[$workgroup, $user] = $this->splitUser($user); // strip domain
if ($user === $this->server->getAuth()->getUsername() && $workgroup == $this->server->getAuth()->getWorkgroup()) {
...

Edit2: On my server I get the following ACLs from $file->getAcls() on a file in a share I use for tvheadend recordings. I had to add a domain to the external share in nextcloud otherwise I could not mount the share at all, I used the server name 'server'.
I added posixacls on a file for my user. As you can see my user 'snafu' is explicitly stated due to the ACL but the getAcls() call returned the domain/workgroup as uppercase, whereas the IAuth object returns it as lowercase. A case insensitive check on the domain/workgroup should be fine (DNS standard says case insensitive) but on the username I would stick to case sensitive (POSIX standard).

...
[$workgroup, $user] = $this->splitUser($user); // strip domain
if ($user === $this->server->getAuth()->getUsername() && strcasecmp($workgroup, $this->server->getAuth()->getWorkgroup()) === 0) {
...

NextcloudDebug[16501]: ACLS: array (
NextcloudDebug[16501]: 'SERVER\snafu' =>
NextcloudDebug[16501]: Icewind\SMB\ACL::__set_state(array(
NextcloudDebug[16501]: 'type' => 0,
NextcloudDebug[16501]: 'flags' => 0,
NextcloudDebug[16501]: 'mask' => 2032127,
NextcloudDebug[16501]: )),
NextcloudDebug[16501]: 'Unix Group\video' =>
NextcloudDebug[16501]: Icewind\SMB\ACL::__set_state(array(
NextcloudDebug[16501]: 'type' => 0,
NextcloudDebug[16501]: 'flags' => 0,
NextcloudDebug[16501]: 'mask' => 1179817,
NextcloudDebug[16501]: )),
NextcloudDebug[16501]: '\Everyone' =>
NextcloudDebug[16501]: Icewind\SMB\ACL::__set_state(array(
NextcloudDebug[16501]: 'type' => 0,
NextcloudDebug[16501]: 'flags' => 0,
NextcloudDebug[16501]: 'mask' => 1179817,
NextcloudDebug[16501]: )),
NextcloudDebug[16501]: )

[Snafu]

I'm not familiar with this ACL user notation containing a slash. Maybe the strpos() check here also has to be changed to strpos($user, '/') !== false

[csware]

Cross-link: #25540

[skjnldsv]

@Snafu would you mind rebasing your PR? :)
Then I should be able to review and ask other coworkers to have a look

[skjnldsv]

Closing this pull request due to lack of recent activity and updates. We appreciate your contribution and encourage you to reopen or provide further updates if necessary. ☺️
Our aim is to keep the project moving forward with active collaboration. Thank you for your understanding and continued support! 🙏

[Snafu]

Hi,
this pull request was no longer relevant because the strpos() calls were refactored to str_contains() in the following commit.

Author: Faraz Samapoor f.samapoor@gmail.com
Date: 02.06.2023 18:24:49
Commit hash: cfb921b

Refactors "strpos" calls in /apps/files_external to improve code readability.

Signed-off-by: Faraz Samapoor f.samapoor@gmail.com