fix(provisioning_api): group admins can't add all users to groups

Group admins can't add users they are not supposed to see to their
groups

Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>

Author: Altahrim

apps/provisioning_api/lib/Controller/UsersController.php

@@ -1368,7 +1368,10 @@ public function addToGroup(string $userId, string $groupid = ''): DataResponse {
 		// If they're not an admin, check they are a subadmin of the group in question
 		$loggedInUser = $this->userSession->getUser();
 		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
+		if (
+			!$this->groupManager->isAdmin($loggedInUser->getUID())
+			&& !($subAdminManager->isSubAdminOfGroup($loggedInUser, $group) && $subAdminManager->isUserAccessible($loggedInUser, $targetUser))
+		) {
 			throw new OCSException('', 104);
 		}
 

apps/provisioning_api/tests/Controller/UsersControllerTest.php

@@ -3102,6 +3102,11 @@ public function testAddToGroupSuccessAsSubadmin() {
 			->with($loggedInUser, $targetGroup)
 			->willReturn(true);
 
+		$subAdminManager->expects($this->once())
+			->method('isUserAccessible')
+			->with($loggedInUser, $targetUser)
+			->willReturn(true);
+
 		$this->groupManager->expects($this->once())
 			->method('getSubAdmin')
 			->willReturn($subAdminManager);