From 7d5ac4f1d0a5d0fcfacbbedc953c068cdee49c7f Mon Sep 17 00:00:00 2001
From: Robin Appelman <robin@icewind.nl>
Date: Wed, 10 Sep 2025 17:45:34 +0200
Subject: [PATCH 1/2] fix: don't allow empty email even if email change is
 allowed

Signed-off-by: Robin Appelman <robin@icewind.nl>
---
 lib/Listener/UserChangedListener.php | 29 +++++++++++++++++++++-------
 lib/Repair/ResetEmails.php           |  6 ++++--
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/lib/Listener/UserChangedListener.php b/lib/Listener/UserChangedListener.php
index f3b7ef1f7..30f9e9af3 100644
--- a/lib/Listener/UserChangedListener.php
+++ b/lib/Listener/UserChangedListener.php
@@ -8,10 +8,12 @@
 
 namespace OCA\Guests\Listener;
 
+use OCA\Guests\AppInfo\Application;
 use OCA\Guests\GuestManager;
 use OCP\EventDispatcher\Event;
 use OCP\EventDispatcher\IEventListener;
 use OCP\IAppConfig;
+use OCP\IConfig;
 use OCP\IUserSession;
 use OCP\User\Events\UserChangedEvent;
 
@@ -25,6 +27,7 @@ public function __construct(
 		private readonly IUserSession $userSession,
 		private readonly GuestManager $guestManager,
 		private readonly IAppConfig $appConfig,
+		private readonly IConfig $config,
 	) {
 	}
 
@@ -36,20 +39,32 @@ public function handle(Event $event): void {
 			return;
 		}
 		$user = $event->getUser();
-		if ($this->userSession->getUser() !== $user) {
+		if (!$this->guestManager->isGuest($user)) {
 			return;
 		}
-		if (!$this->guestManager->isGuest($user)) {
+
+		$guestEmail = $this->config->getUserValue($user->getUID(), Application::APP_ID, 'email', strtolower($user->getUID()));
+		if ($event->getValue() === $guestEmail) {
 			return;
 		}
+
+		$allowChange = false;
 		if (strtolower($event->getValue()) === strtolower($user->getUID())) {
-			return;
+			$allowChange = true;
 		}
-		if ($this->appConfig->getValueBool('guests', 'allow_email_change', false, true)) {
-			return;
+
+		if ($this->userSession->getUser() !== $user) {
+			$allowChange = true;
+		}
+		if ($this->appConfig->getValueBool(Application::APP_ID, 'allow_email_change', false, true) && $event->getValue() !== '') {
+			$allowChange = true;
 		}
 
-		$user->setSystemEMailAddress(strtolower($user->getUID()));
-		$event->stopPropagation();
+		if ($allowChange) {
+			$this->config->setUserValue($user->getUID(), Application::APP_ID, 'email', $event->getValue());
+		} else {
+			$user->setSystemEMailAddress($guestEmail);
+			$event->stopPropagation();
+		}
 	}
 }
diff --git a/lib/Repair/ResetEmails.php b/lib/Repair/ResetEmails.php
index 7f1521f2b..616b41ad1 100644
--- a/lib/Repair/ResetEmails.php
+++ b/lib/Repair/ResetEmails.php
@@ -8,6 +8,7 @@
 
 namespace OCA\Guests\Repair;
 
+use OCA\Guests\AppInfo\Application;
 use OCA\Guests\GuestManager;
 use OCP\IAppConfig;
 use OCP\IConfig;
@@ -38,9 +39,10 @@ public function run(IOutput $output) {
 
 		foreach ($this->guestManager->listGuests() as $guestId) {
 			$guest = $this->userManager->get($guestId);
-			if (strtolower($guest?->getSystemEMailAddress() ?? '') !== strtolower($guestId)) {
+			$expectedEmail = $this->config->getUserValue($guestId, Application::APP_ID, 'email', strtolower($guestId));
+			if (strtolower($guest?->getSystemEMailAddress() ?? '') !== $expectedEmail) {
 				$this->config->setUserValue($guestId, 'guests', 'old_email', $guest?->getSystemEMailAddress() ?? '');
-				$guest->setSystemEMailAddress(strtolower($guestId));
+				$guest->setSystemEMailAddress($expectedEmail);
 			}
 		}
 	}

From b901548739e50d1a79083d1b222da8f2b2833b6e Mon Sep 17 00:00:00 2001
From: Robin Appelman <robin@icewind.nl>
Date: Mon, 15 Sep 2025 16:59:52 +0200
Subject: [PATCH 2/2] chore: 4.5.2

Signed-off-by: Robin Appelman <robin@icewind.nl>
---
 appinfo/info.xml                     | 2 +-
 lib/Listener/UserChangedListener.php | 7 ++-----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/appinfo/info.xml b/appinfo/info.xml
index 5374929be..b4275b396 100755
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -14,7 +14,7 @@
 Guests accounts can be created from the share menu by entering either the recipients email or name and choosing "create guest account", once the share is created the guest user will receive an email notification about the mail with a link to set their password.
 
 Guests users can only access files shared to them and cannot create any files outside of shares, additionally, the apps accessible to guest accounts are whitelisted.]]></description>
-	<version>4.5.1</version>
+	<version>4.5.2</version>
 	<licence>agpl</licence>
 	<author>Nextcloud</author>
 	<types>
diff --git a/lib/Listener/UserChangedListener.php b/lib/Listener/UserChangedListener.php
index 30f9e9af3..28b689127 100644
--- a/lib/Listener/UserChangedListener.php
+++ b/lib/Listener/UserChangedListener.php
@@ -51,12 +51,9 @@ public function handle(Event $event): void {
 		$allowChange = false;
 		if (strtolower($event->getValue()) === strtolower($user->getUID())) {
 			$allowChange = true;
-		}
-
-		if ($this->userSession->getUser() !== $user) {
+		} elseif ($this->userSession->getUser() !== $user) {
 			$allowChange = true;
-		}
-		if ($this->appConfig->getValueBool(Application::APP_ID, 'allow_email_change', false, true) && $event->getValue() !== '') {
+		} elseif ($this->appConfig->getValueBool(Application::APP_ID, 'allow_email_change', false, true) && $event->getValue() !== '') {
 			$allowChange = true;
 		}