Skip to content

Commit 372cb9e

Browse files
CarlSchwanCarlSchwan
committed
Add support for Delegation Settings for more apps
* This adds support for the sharing, groupware, theming and user_ldap app * This adds some code who disapeared during a rebase in the initial delegation PR (provisioning_api) Signed-off-by: Carl Schwan <carl@carlschwan.eu>
1 parent b585cf1 commit 372cb9e

13 files changed

Lines changed: 197 additions & 32 deletions

File tree

‎apps/dav/lib/Controller/BirthdayCalendarController.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ public function __construct($appName, IRequest $request,
8888

8989
/**
9090
* @return Response
91+
* @AuthorizedAdminSetting(settings=OCA\DAV\Settings\CalDAVSettings)
9192
*/
9293
public function enable() {
9394
$this->config->setAppValue($this->appName, 'generateBirthdayCalendar', 'yes');
@@ -104,6 +105,7 @@ public function enable() {
104105

105106
/**
106107
* @return Response
108+
* @AuthorizedAdminSetting(settings=OCA\DAV\Settings\CalDAVSettings)
107109
*/
108110
public function disable() {
109111
$this->config->setAppValue($this->appName, 'generateBirthdayCalendar', 'no');

‎apps/dav/lib/Settings/CalDAVSettings.php‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,23 @@
2929
use OCP\AppFramework\Http\TemplateResponse;
3030
use OCP\IConfig;
3131
use OCP\AppFramework\Services\IInitialState;
32-
use OCP\Settings\ISettings;
32+
use OCP\Settings\IDelegatedSettings;
3333

34-
class CalDAVSettings implements ISettings {
34+
class CalDAVSettings implements IDelegatedSettings {
3535

3636
/** @var IConfig */
3737
private $config;
3838

3939
/** @var IInitialState */
4040
private $initialState;
4141

42+
private const defaults = [
43+
'sendInvitations' => 'yes',
44+
'generateBirthdayCalendar' => 'yes',
45+
'sendEventReminders' => 'yes',
46+
'sendEventRemindersPush' => 'no',
47+
];
48+
4249
/**
4350
* CalDAVSettings constructor.
4451
*
@@ -51,13 +58,7 @@ public function __construct(IConfig $config, IInitialState $initialState) {
5158
}
5259

5360
public function getForm(): TemplateResponse {
54-
$defaults = [
55-
'sendInvitations' => 'yes',
56-
'generateBirthdayCalendar' => 'yes',
57-
'sendEventReminders' => 'yes',
58-
'sendEventRemindersPush' => 'no',
59-
];
60-
foreach ($defaults as $key => $default) {
61+
foreach (self::defaults as $key => $default) {
6162
$value = $this->config->getAppValue(Application::APP_ID, $key, $default);
6263
$this->initialState->provideInitialState($key, $value === 'yes');
6364
}
@@ -77,4 +78,14 @@ public function getSection() {
7778
public function getPriority() {
7879
return 10;
7980
}
81+
82+
public function getName(): ?string {
83+
return null; // Only setting in this section
84+
}
85+
86+
public function getAuthorizedAppConfig(): array {
87+
return [
88+
'dav' => ['/(' . implode('|', array_keys(self::defaults)) . ')/']
89+
];
90+
}
8091
}

‎apps/federatedfilesharing/lib/Settings/Admin.php‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,25 +27,30 @@
2727
use OCA\FederatedFileSharing\FederatedShareProvider;
2828
use OCP\AppFramework\Http\TemplateResponse;
2929
use OCP\GlobalScale\IConfig;
30-
use OCP\Settings\ISettings;
30+
use OCP\IL10N;
31+
use OCP\Settings\IDelegatedSettings;
3132

32-
class Admin implements ISettings {
33+
class Admin implements IDelegatedSettings {
3334

3435
/** @var FederatedShareProvider */
3536
private $fedShareProvider;
3637

3738
/** @var IConfig */
3839
private $gsConfig;
3940

41+
/** @var IL10N */
42+
private $l;
43+
4044
/**
4145
* Admin constructor.
4246
*
4347
* @param FederatedShareProvider $fedShareProvider
4448
* @param IConfig $globalScaleConfig
4549
*/
46-
public function __construct(FederatedShareProvider $fedShareProvider, IConfig $globalScaleConfig) {
50+
public function __construct(FederatedShareProvider $fedShareProvider, IConfig $globalScaleConfig, IL10N $l) {
4751
$this->fedShareProvider = $fedShareProvider;
4852
$this->gsConfig = $globalScaleConfig;
53+
$this->l = $l;
4954
}
5055

5156
/**
@@ -83,4 +88,22 @@ public function getSection() {
8388
public function getPriority() {
8489
return 20;
8590
}
91+
92+
public function getName(): ?string {
93+
return $this->l->t('Federated Cloud Sharing');
94+
}
95+
96+
public function getAuthorizedAppConfig(): array {
97+
return [
98+
'files_sharing' => [
99+
'outgoing_server2server_share_enabled',
100+
'incoming_server2server_share_enabled',
101+
'federatedGroupSharingSupported',
102+
'outgoingServer2serverGroupShareEnabled',
103+
'incomingServer2serverGroupShareEnabled',
104+
'lookupServerEnabled',
105+
'lookupServerUploadEnabled',
106+
],
107+
];
108+
}
86109
}

‎apps/federation/lib/Controller/SettingsController.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,9 @@ public function __construct($AppName,
5656

5757

5858
/**
59-
* add server to the list of trusted Nextclouds
59+
* Add server to the list of trusted Nextclouds.
6060
*
61+
* @AuthorizedAdminSetting(settings=OCA\Federation\Settings\Admin)
6162
* @param string $url
6263
* @return DataResponse
6364
* @throws HintException
@@ -76,8 +77,9 @@ public function addServer($url) {
7677
}
7778

7879
/**
79-
* add server to the list of trusted Nextclouds
80+
* Add server to the list of trusted Nextclouds.
8081
*
82+
* @AuthorizedAdminSetting(settings=OCA\Federation\Settings\Admin)
8183
* @param int $id
8284
* @return DataResponse
8385
*/
@@ -87,8 +89,9 @@ public function removeServer($id) {
8789
}
8890

8991
/**
90-
* check if the server should be added to the list of trusted servers or not
92+
* Check if the server should be added to the list of trusted servers or not.
9193
*
94+
* @AuthorizedAdminSetting(settings=OCA\Federation\Settings\Admin)
9295
* @param string $url
9396
* @return bool
9497
* @throws HintException

‎apps/federation/lib/Settings/Admin.php‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,26 @@
2424

2525
use OCA\Federation\TrustedServers;
2626
use OCP\AppFramework\Http\TemplateResponse;
27-
use OCP\Settings\ISettings;
27+
use OCP\IL10N;
28+
use OCP\Settings\IDelegatedSettings;
2829

29-
class Admin implements ISettings {
30+
class Admin implements IDelegatedSettings {
3031

3132
/** @var TrustedServers */
3233
private $trustedServers;
3334

34-
public function __construct(TrustedServers $trustedServers) {
35+
/** @var IL10N */
36+
private $l;
37+
38+
/**
39+
* Admin constructor.
40+
*
41+
* @param TrustedServers $trustedServers
42+
* @param IL10N $l
43+
*/
44+
public function __construct(TrustedServers $trustedServers, IL10N $l) {
3545
$this->trustedServers = $trustedServers;
46+
$this->l = $l;
3647
}
3748

3849
/**
@@ -63,4 +74,12 @@ public function getSection() {
6374
public function getPriority() {
6475
return 30;
6576
}
77+
78+
public function getName(): ?string {
79+
return $this->l->t("Trusted servers");
80+
}
81+
82+
public function getAuthorizedAppConfig(): array {
83+
return []; // Handled by custom controller
84+
}
6685
}

‎apps/provisioning_api/lib/Controller/AppConfigController.php‎

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,19 @@
2626
*/
2727
namespace OCA\Provisioning_API\Controller;
2828

29+
use OC\AppFramework\Middleware\Security\Exceptions\NotAdminException;
2930
use OCP\AppFramework\Http;
3031
use OCP\AppFramework\Http\DataResponse;
3132
use OCP\AppFramework\OCSController;
3233
use OCP\IAppConfig;
3334
use OCP\IConfig;
35+
use OCP\IGroupManager;
36+
use OCP\IL10N;
3437
use OCP\IRequest;
38+
use OCP\IUser;
39+
use OCP\IUserSession;
40+
use OCP\Settings\IDelegatedSettings;
41+
use OCP\Settings\IManager;
3542

3643
class AppConfigController extends OCSController {
3744

@@ -41,6 +48,18 @@ class AppConfigController extends OCSController {
4148
/** @var IAppConfig */
4249
protected $appConfig;
4350

51+
/** @var IUserSession */
52+
private $userSession;
53+
54+
/** @var IL10N */
55+
private $l10n;
56+
57+
/** @var IGroupManager */
58+
private $groupManager;
59+
60+
/** @var IManager */
61+
private $settingManager;
62+
4463
/**
4564
* @param string $appName
4665
* @param IRequest $request
@@ -50,10 +69,18 @@ class AppConfigController extends OCSController {
5069
public function __construct(string $appName,
5170
IRequest $request,
5271
IConfig $config,
53-
IAppConfig $appConfig) {
72+
IAppConfig $appConfig,
73+
IUserSession $userSession,
74+
IL10N $l10n,
75+
IGroupManager $groupManager,
76+
IManager $settingManager) {
5477
parent::__construct($appName, $request);
5578
$this->config = $config;
5679
$this->appConfig = $appConfig;
80+
$this->userSession = $userSession;
81+
$this->l10n = $l10n;
82+
$this->groupManager = $groupManager;
83+
$this->settingManager = $settingManager;
5784
}
5885

5986
/**
@@ -99,12 +126,23 @@ public function getValue(string $app, string $key, string $defaultValue = ''): D
99126

100127
/**
101128
* @PasswordConfirmationRequired
129+
* @NoSubAdminRequired
130+
* @NoAdminRequired
102131
* @param string $app
103132
* @param string $key
104133
* @param string $value
105134
* @return DataResponse
106135
*/
107136
public function setValue(string $app, string $key, string $value): DataResponse {
137+
$user = $this->userSession->getUser();
138+
if ($user === null) {
139+
throw new \Exception("User is not logged in."); // Should not happen, since method is guarded by middleware
140+
}
141+
142+
if (!$this->isAllowedToChangedKey($user, $app, $key)) {
143+
throw new NotAdminException($this->l10n->t('Logged in user must be an admin or have authorization to edit this setting.'));
144+
}
145+
108146
try {
109147
$this->verifyAppId($app);
110148
$this->verifyConfigKey($app, $key, $value);
@@ -170,4 +208,30 @@ protected function verifyConfigKey(string $app, string $key, string $value) {
170208
throw new \InvalidArgumentException('The given key can not be set, unlimited quota is forbidden on this instance');
171209
}
172210
}
211+
212+
private function isAllowedToChangedKey(IUser $user, string $app, string $key): bool {
213+
// Admin right verification
214+
$isAdmin = $this->groupManager->isAdmin($user->getUID());
215+
if ($isAdmin) {
216+
return true;
217+
}
218+
219+
$settings = $this->settingManager->getAllAllowedAdminSettings($user);
220+
foreach ($settings as $setting) {
221+
if (!($setting instanceof IDelegatedSettings)) {
222+
continue;
223+
}
224+
$allowedKeys = $setting->getAuthorizedAppConfig();
225+
if (!array_key_exists($app, $allowedKeys)) {
226+
continue;
227+
}
228+
foreach ($allowedKeys[$app] as $regex) {
229+
if ($regex === $key
230+
|| (str_starts_with($regex, '/') && preg_match($regex, $key) === 1)) {
231+
return true;
232+
}
233+
}
234+
}
235+
return false;
236+
}
173237
}

‎apps/provisioning_api/lib/Controller/GroupsController.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,10 @@ public function getGroups(string $search = '', int $limit = null, int $offset =
9696
}
9797

9898
/**
99-
* returns a list of groups details with ids and displaynames
99+
* Returns a list of groups details with ids and displaynames
100100
*
101101
* @NoAdminRequired
102+
* @AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Sharing)
102103
*
103104
* @param string $search
104105
* @param int $limit

‎apps/provisioning_api/lib/Middleware/ProvisioningApiMiddleware.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ public function __construct(
7070
* @throws NotSubAdminException
7171
*/
7272
public function beforeController($controller, $methodName) {
73-
if (!$this->isAdmin && !$this->reflector->hasAnnotation('NoSubAdminRequired') && !$this->isSubAdmin) {
73+
// If AuthorizedAdminSetting, the check will be done in the SecurityMiddleware
74+
if (!$this->isAdmin && !$this->reflector->hasAnnotation('NoSubAdminRequired') && !$this->isSubAdmin && !$this->reflector->hasAnnotation('AuthorizedAdminSetting')) {
7475
throw new NotSubAdminException();
7576
}
7677
}

‎apps/sharebymail/lib/Settings/Admin.php‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,20 @@
2424
namespace OCA\ShareByMail\Settings;
2525

2626
use OCP\AppFramework\Http\TemplateResponse;
27-
use OCP\Settings\ISettings;
27+
use OCP\IL10N;
28+
use OCP\Settings\IDelegatedSettings;
2829

29-
class Admin implements ISettings {
30+
class Admin implements IDelegatedSettings {
3031

3132
/** @var SettingsManager */
3233
private $settingsManager;
3334

34-
public function __construct(SettingsManager $settingsManager) {
35+
/** @var IL10N */
36+
private $l;
37+
38+
public function __construct(SettingsManager $settingsManager, IL10N $l) {
3539
$this->settingsManager = $settingsManager;
40+
$this->l = $l;
3641
}
3742

3843
/**
@@ -64,4 +69,14 @@ public function getSection() {
6469
public function getPriority() {
6570
return 40;
6671
}
72+
73+
public function getName(): ?string {
74+
return $this->l->t('Share by mail');
75+
}
76+
77+
public function getAuthorizedAppConfig(): array {
78+
return [
79+
'sharebymail' => ['s/(sendpasswordmail|replyToInitiator)/'],
80+
];
81+
}
6782
}

0 commit comments

Comments
 (0)