The patch looks pretty straight forward, thanks.

This is where I am as far as permissions-management in a 
backend-hook-using environment. I am testing these with mnemo with the 
assumption that once it works there it will work everywhere.  I am 
having other issues with mnemo duplicating notepads that may or may 
not be related to this.



I hope you will look at these and see more general fixes to the 
particular problems I am battling.

I accept that my concept of the backend hooks might have been skewed.   
I can make FTP and other "backend" services use the internal username 
for authentication.  That will even add an extra level of "security 
through obscurity" without lessening password protection.



I have been looking at templates/shares/edit.inc and 
services/shares/edit.php.  I tweaked the former by adding 
Auth::removeHook() calls in appropriate places and it seems to be 
doing what it should.  I was having difficulties with getting edit.php 
to call Auth::addHook() in the correct places, then I was called away 
to something else.



I hope to get back to working on this for the time being, to the point 
of having patches for edit.inc at least by this afternoon

So, to make sure I'm clear on what the fixes would be:



- When displaying usernames with shares, run them through 
username_hook_frombackend

- When saving usernames for shares, run them through username_hook_tobackend



That seems pretty straightforward and in the spirit of those hooks. 
The other stuff, though, is getting a little hairy. The username hooks 
have historically been for translating the username to _the_ backend 
username, across all backends, not just to the Horde backend. Many 
people would use them to translate a user-friendly username to a fully 
qualified username that is then used for all services, like LDAP.



So I think a different concept or hook might be necessary to represent 
a "Horde internal" vs. "All other external" username.

I used uidNumber as an internal handle so usernames can be changed 
without loss of data stored in horde.  Now I find that horde is trying 
to use the handle for accessing non-horde services, such as FTP 
storage of ingo scripts and LDAP lookups for group memberships.  It 
also required me to enter the uidNumber for a user to share with a 
specific individual, rather than their username.