fix(settings): Fix config handling

Signed-off-by: provokateurin <kate@provokateurin.de>
nextcloud · Sep 30, 2024 · a0414f6 · a0414f6
1 parent dedb44f
commit a0414f6
Show file tree

Hide file tree

Showing 4 changed files with 100 additions and 0 deletions.
diff --git a/lib/Controller/FolderController.php b/lib/Controller/FolderController.php
@@ -27,6 +27,7 @@
 use OCA\GroupFolders\Service\DelegationService;
 use OCA\GroupFolders\Service\FoldersFilter;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCSController;
 use OCP\Files\IRootFolder;
@@ -114,6 +115,7 @@ private function getRootFolderStorageId(): ?int {
 	 * @RequireGroupFolderAdmin
 	 * @NoAdminRequired
 	 */
+	#[PasswordConfirmationRequired]
 	public function addFolder(string $mountpoint): DataResponse {
 		$id = $this->manager->createFolder($mountpoint);
 		return new DataResponse(['id' => $id]);
@@ -123,6 +125,7 @@ public function addFolder(string $mountpoint): DataResponse {
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function removeFolder(int $id): DataResponse {
 		$response = $this->checkFolderExists($id);
 		if ($response) {
@@ -138,6 +141,7 @@ public function removeFolder(int $id): DataResponse {
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function setMountPoint(int $id, string $mountPoint): DataResponse {
 		$this->manager->setMountPoint($id, $mountPoint);
 		return new DataResponse(['success' => true]);
@@ -147,6 +151,7 @@ public function setMountPoint(int $id, string $mountPoint): DataResponse {
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function addGroup(int $id, string $group): DataResponse {
 	$response = $this->checkFolderExists($id);
 	if ($response) {
@@ -160,6 +165,7 @@ public function addGroup(int $id, string $group): DataResponse {
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function removeGroup(int $id, string $group): DataResponse {
 	$response = $this->checkFolderExists($id);
 	if ($response) {
@@ -173,6 +179,7 @@ public function removeGroup(int $id, string $group): DataResponse {
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function setPermissions(int $id, string $group, int $permissions): DataResponse {
 	$response = $this->checkFolderExists($id);
 	if ($response) {
@@ -187,6 +194,7 @@ public function setPermissions(int $id, string $group, int $permissions): DataRe
 	 * @RequireGroupFolderAdmin
 	 * @throws \OCP\DB\Exception
 	 */
+	#[PasswordConfirmationRequired]
 	public function setManageACL(int $id, string $mappingType, string $mappingId, bool $manageAcl): DataResponse {
 	$response = $this->checkFolderExists($id);
 	if ($response) {
@@ -200,6 +208,7 @@ public function setManageACL(int $id, string $mappingType, string $mappingId, bo
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function setQuota(int $id, int $quota): DataResponse {
 	$response = $this->checkFolderExists($id);
 	if ($response) {
@@ -213,6 +222,7 @@ public function setQuota(int $id, int $quota): DataResponse {
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function setACL(int $id, bool $acl): DataResponse {
 	$response = $this->checkFolderExists($id);
 	if ($response) {
@@ -226,6 +236,7 @@ public function setACL(int $id, bool $acl): DataResponse {
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
 	 */
+	#[PasswordConfirmationRequired]
 	public function renameFolder(int $id, string $mountpoint): DataResponse {
 	$response = $this->checkFolderExists($id);
 	if ($response) {

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -34,6 +34,7 @@
   "dependencies": {
     "@nextcloud/axios": "^2.3.0",
     "@nextcloud/event-bus": "^3.0.2",
+  	"@nextcloud/password-confirmation": "4.0.4",
     "@nextcloud/router": "^2.0.1",
     "@nextcloud/vue": "^7.7.1",
     "nextcloud-server": "^0.15.10",

diff --git a/src/settings/Api.ts b/src/settings/Api.ts
@@ -1,5 +1,6 @@
 import axios from '@nextcloud/axios'
 import { generateUrl } from "@nextcloud/router";
+import { confirmPassword } from '@nextcloud/password-confirmation'
 // eslint-disable-next-line n/no-unpublished-import
 import type { OCSResponse } from '@nextcloud/typings/lib/ocs'
 
@@ -59,34 +60,48 @@ export class Api {
 
 	// Updates the list of groups that have been granted delegated admin or subadmin rights on groupfolders
 	async updateDelegatedGroups(newGroups: Group[], classname: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(generateUrl('/apps/settings/') + '/settings/authorizedgroups/saveSettings', {
 			newGroups,
 			class: classname,
 		})
 	}
 
 	async createFolder(mountPoint: string): Promise<number> {
+		await confirmPassword()
+
 		const response = await axios.post<OCSResponse<number>>(this.getUrl('folders'), { mountpoint: mountPoint })
 		return response.data.ocs.data
 	}
 
 	async deleteFolder(id: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.delete(this.getUrl(`folders/${id}`))
 	}
 
 	async addGroup(folderId: number, group: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/groups`), { group })
 	}
 
 	async removeGroup(folderId: number, group: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.delete(this.getUrl(`folders/${folderId}/groups/${group}`))
 	}
 
 	async setPermissions(folderId: number, group: string, permissions: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/groups/${group}`), { permissions })
 	}
 
 	async setManageACL(folderId: number, type: string, id: string, manageACL: boolean): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/manageACL`), {
 			mappingType: type,
 			mappingId: id,
@@ -95,14 +110,20 @@ export class Api {
 	}
 
 	async setQuota(folderId: number, quota: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/quota`), { quota })
 	}
 
 	async setACL(folderId: number, acl: boolean): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/acl`), { acl: acl ? 1 : 0 })
 	}
 
 	async renameFolder(folderId: number, mountpoint: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/mountpoint`), { mountpoint })
 	}