Henrique Dias 883a36f02f fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7) ... cleanUsername is many-to-one, so distinct usernames (e.g. "teamone/x" and "teamone-x") can normalize to the same home directory. With CreateUserDir enabled, the second registrant silently reused the first user's directory, breaking per-user isolation. Add a GetByScope lookup and reject a signup whose derived scope is already taken. The check is gated on CreateUserDir: when it is off, signups intentionally share the configured default scope. Adds a regression test for the colliding-username case.		2026-06-27 09:08:56 +02:00
..
assets	fix: passthrough the minimum password length (#5236)	2025-06-29 11:28:32 +02:00
assets.go	chore: remove 'nolint' comments	2025-11-15 09:01:21 +01:00
password.go	refactor: cleanup package names (#5605)	2025-12-06 10:52:11 +01:00
permissions.go	feat: v2 (#599)	2019-01-05 22:44:33 +00:00
storage.go	fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7)	2026-06-27 09:08:56 +02:00
storage_test.go	feat: allow to password protect shares (#1252)	2021-03-02 12:00:18 +01:00
users.go	fix: restore symlink behavior as opt-in followExternalSymlinks	2026-06-23 13:19:51 +02:00
users_test.go	fix: restore symlink behavior as opt-in followExternalSymlinks	2026-06-23 13:19:51 +02:00