"invitations" leak all usernames

[meaz]

What is going wrong?

As an user, I can find all usernames in my instance by using the "Invitations" feature.

To Reproduce

1. As an admin, "Allow username autocompletion in share dialog. If this is disabled the full username or email address needs to be entered" is disabled
2. Create a poll as user
3. Go to Details, then Shares
4. Start typing something in the box under " Invited users will get informed immediately via eMail!"

Expected behavior
As an user, I should not be able to see all usernames existing on the instance.
I should be able to add an user for an invitation only if I know his/her username fully, not my guessing it by writing some letters only.

Information about your polls installation

1.30
Fresh installation
Appstore

Information about your Instance of Nextcloud/ownCloud

Nextcloud 18

[dartcafe]

Interesting, I thought, this is handled by the core, when suing the user API. We will have to check this.

[oafgip]

Hello,
Aren't invitations supposed to be limited to groups?
When user of a group tries to share a poll, the list of other groups is proposed. Is there any trick to restrict to the group of the user?
Regards.

[dartcafe]

Aren't invitations supposed to be limited to groups?

No. There is no limitation.

[dartcafe]

#1307 uses another search which respects the autocomplete limitations of the share settings (users and groups).

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.