Skip to content

Commit 083ffeb

Browse files
CarlSchwanCarlSchwan
committed
feat: Add missing NoSubAdminRequired attribute
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
1 parent 811edb0 commit 083ffeb

21 files changed

Lines changed: 104 additions & 171 deletions

‎apps/provisioning_api/lib/Controller/AppConfigController.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
use OCP\App\IAppManager;
1616
use OCP\AppFramework\Http;
1717
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
18+
use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
1819
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
1920
use OCP\AppFramework\Http\DataResponse;
2021
use OCP\AppFramework\OCSController;
@@ -102,8 +103,6 @@ public function getValue(string $app, string $key, string $defaultValue = ''): D
102103
}
103104

104105
/**
105-
* @NoSubAdminRequired
106-
*
107106
* Update the config value of an app
108107
*
109108
* @param string $app ID of the app
@@ -116,6 +115,7 @@ public function getValue(string $app, string $key, string $defaultValue = ''): D
116115
*/
117116
#[PasswordConfirmationRequired]
118117
#[NoAdminRequired]
118+
#[NoSubAdminRequired]
119119
public function setValue(string $app, string $key, string $value): DataResponse {
120120
$user = $this->userSession->getUser();
121121
if ($user === null) {

‎apps/provisioning_api/lib/Controller/GroupsController.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
use OCP\AppFramework\Http;
1818
use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
1919
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
20+
use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
2021
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
2122
use OCP\AppFramework\Http\DataResponse;
2223
use OCP\AppFramework\OCS\OCSException;
@@ -138,8 +139,6 @@ public function getGroup(string $groupId): DataResponse {
138139
}
139140

140141
/**
141-
* @NoSubAdminRequired
142-
*
143142
* Get a list of users in the specified group
144143
*
145144
* @param string $groupId ID of the group
@@ -151,6 +150,7 @@ public function getGroup(string $groupId): DataResponse {
151150
* 200: User IDs returned
152151
*/
153152
#[NoAdminRequired]
153+
#[NoSubAdminRequired]
154154
public function getGroupUsers(string $groupId): DataResponse {
155155
$groupId = urldecode($groupId);
156156

‎apps/provisioning_api/lib/Controller/PreferencesController.php‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
use OCP\AppFramework\Http;
1313
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
14+
use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
1415
use OCP\AppFramework\Http\DataResponse;
1516
use OCP\AppFramework\OCSController;
1617
use OCP\Config\BeforePreferenceDeletedEvent;
@@ -33,8 +34,6 @@ public function __construct(
3334
}
3435

3536
/**
36-
* @NoSubAdminRequired
37-
*
3837
* Update multiple preference values of an app
3938
*
4039
* @param string $appId ID of the app
@@ -46,6 +45,7 @@ public function __construct(
4645
* 400: Preference invalid
4746
*/
4847
#[NoAdminRequired]
48+
#[NoSubAdminRequired]
4949
public function setMultiplePreferences(string $appId, array $configs): DataResponse {
5050
$userId = $this->userSession->getUser()->getUID();
5151

@@ -78,8 +78,6 @@ public function setMultiplePreferences(string $appId, array $configs): DataRespo
7878
}
7979

8080
/**
81-
* @NoSubAdminRequired
82-
*
8381
* Update a preference value of an app
8482
*
8583
* @param string $appId ID of the app
@@ -91,6 +89,7 @@ public function setMultiplePreferences(string $appId, array $configs): DataRespo
9189
* 400: Preference invalid
9290
*/
9391
#[NoAdminRequired]
92+
#[NoSubAdminRequired]
9493
public function setPreference(string $appId, string $configKey, string $configValue): DataResponse {
9594
$userId = $this->userSession->getUser()->getUID();
9695

@@ -119,8 +118,6 @@ public function setPreference(string $appId, string $configKey, string $configVa
119118
}
120119

121120
/**
122-
* @NoSubAdminRequired
123-
*
124121
* Delete multiple preferences for an app
125122
*
126123
* @param string $appId ID of the app
@@ -132,6 +129,7 @@ public function setPreference(string $appId, string $configKey, string $configVa
132129
* 400: Preference invalid
133130
*/
134131
#[NoAdminRequired]
132+
#[NoSubAdminRequired]
135133
public function deleteMultiplePreference(string $appId, array $configKeys): DataResponse {
136134
$userId = $this->userSession->getUser()->getUID();
137135

@@ -162,8 +160,6 @@ public function deleteMultiplePreference(string $appId, array $configKeys): Data
162160
}
163161

164162
/**
165-
* @NoSubAdminRequired
166-
*
167163
* Delete a preference for an app
168164
*
169165
* @param string $appId ID of the app
@@ -174,6 +170,7 @@ public function deleteMultiplePreference(string $appId, array $configKeys): Data
174170
* 400: Preference invalid
175171
*/
176172
#[NoAdminRequired]
173+
#[NoSubAdminRequired]
177174
public function deletePreference(string $appId, string $configKey): DataResponse {
178175
$userId = $this->userSession->getUser()->getUID();
179176

‎apps/provisioning_api/lib/Controller/UsersController.php‎

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
use OCP\AppFramework\Http;
2727
use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
2828
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
29+
use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
2930
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
3031
use OCP\AppFramework\Http\Attribute\UserRateLimit;
3132
use OCP\AppFramework\Http\DataResponse;
@@ -349,8 +350,6 @@ public function getLastLoggedInUsers(
349350
}
350351

351352
/**
352-
* @NoSubAdminRequired
353-
*
354353
* Search users by their phone numbers
355354
*
356355
* @param string $location Location of the phone number (for country code)
@@ -360,6 +359,7 @@ public function getLastLoggedInUsers(
360359
* 200: Users returned
361360
* 400: Invalid location
362361
*/
362+
#[NoSubAdminRequired]
363363
#[NoAdminRequired]
364364
public function searchByPhoneNumbers(string $location, array $search): DataResponse {
365365
if ($this->phoneNumberUtil->getCountryCodeForRegion($location) === null) {
@@ -656,8 +656,6 @@ public function addUser(
656656
}
657657

658658
/**
659-
* @NoSubAdminRequired
660-
*
661659
* Get the details of a user
662660
*
663661
* @param string $userId ID of the user
@@ -667,6 +665,7 @@ public function addUser(
667665
* 200: User returned
668666
*/
669667
#[NoAdminRequired]
668+
#[NoSubAdminRequired]
670669
public function getUser(string $userId): DataResponse {
671670
$includeScopes = false;
672671
$currentUser = $this->userSession->getUser();
@@ -683,8 +682,6 @@ public function getUser(string $userId): DataResponse {
683682
}
684683

685684
/**
686-
* @NoSubAdminRequired
687-
*
688685
* Get the details of the current user
689686
*
690687
* @return DataResponse<Http::STATUS_OK, Provisioning_APIUserDetails, array{}>
@@ -693,6 +690,7 @@ public function getUser(string $userId): DataResponse {
693690
* 200: Current user returned
694691
*/
695692
#[NoAdminRequired]
693+
#[NoSubAdminRequired]
696694
public function getCurrentUser(): DataResponse {
697695
$user = $this->userSession->getUser();
698696
if ($user) {
@@ -705,8 +703,6 @@ public function getCurrentUser(): DataResponse {
705703
}
706704

707705
/**
708-
* @NoSubAdminRequired
709-
*
710706
* Get a list of fields that are editable for the current user
711707
*
712708
* @return DataResponse<Http::STATUS_OK, list<string>, array{}>
@@ -715,6 +711,7 @@ public function getCurrentUser(): DataResponse {
715711
* 200: Editable fields returned
716712
*/
717713
#[NoAdminRequired]
714+
#[NoSubAdminRequired]
718715
public function getEditableFields(): DataResponse {
719716
$currentLoggedInUser = $this->userSession->getUser();
720717
if (!$currentLoggedInUser instanceof IUser) {
@@ -738,8 +735,6 @@ public function getEnabledApps(): DataResponse {
738735
}
739736

740737
/**
741-
* @NoSubAdminRequired
742-
*
743738
* Get a list of fields that are editable for a user
744739
*
745740
* @param string $userId ID of the user
@@ -749,6 +744,7 @@ public function getEnabledApps(): DataResponse {
749744
* 200: Editable fields for user returned
750745
*/
751746
#[NoAdminRequired]
747+
#[NoSubAdminRequired]
752748
public function getEditableFieldsForUser(string $userId): DataResponse {
753749
$currentLoggedInUser = $this->userSession->getUser();
754750
if (!$currentLoggedInUser instanceof IUser) {
@@ -794,8 +790,6 @@ public function getEditableFieldsForUser(string $userId): DataResponse {
794790
}
795791

796792
/**
797-
* @NoSubAdminRequired
798-
*
799793
* Update multiple values of the user's details
800794
*
801795
* @param string $userId ID of the user
@@ -809,6 +803,7 @@ public function getEditableFieldsForUser(string $userId): DataResponse {
809803
*/
810804
#[PasswordConfirmationRequired]
811805
#[NoAdminRequired]
806+
#[NoSubAdminRequired]
812807
#[UserRateLimit(limit: 5, period: 60)]
813808
public function editUserMultiValue(
814809
string $userId,
@@ -1173,8 +1168,6 @@ private function validatePasswordChange(IUser $targetUser, string $password): ?a
11731168
}
11741169

11751170
/**
1176-
* @NoSubAdminRequired
1177-
*
11781171
* Update a value of the user's details
11791172
*
11801173
* @param string $userId ID of the user
@@ -1187,6 +1180,7 @@ private function validatePasswordChange(IUser $targetUser, string $password): ?a
11871180
*/
11881181
#[PasswordConfirmationRequired]
11891182
#[NoAdminRequired]
1183+
#[NoSubAdminRequired]
11901184
#[UserRateLimit(limit: 50, period: 600)]
11911185
public function editUser(string $userId, string $key, string $value): DataResponse {
11921186
$currentLoggedInUser = $this->userSession->getUser();
@@ -1611,8 +1605,6 @@ private function setEnabled(string $userId, bool $value): DataResponse {
16111605
}
16121606

16131607
/**
1614-
* @NoSubAdminRequired
1615-
*
16161608
* Get a list of groups the user belongs to
16171609
*
16181610
* @param string $userId ID of the user
@@ -1622,6 +1614,7 @@ private function setEnabled(string $userId, bool $value): DataResponse {
16221614
* 200: Users groups returned
16231615
*/
16241616
#[NoAdminRequired]
1617+
#[NoSubAdminRequired]
16251618
public function getUsersGroups(string $userId): DataResponse {
16261619
$loggedInUser = $this->userSession->getUser();
16271620

@@ -1656,8 +1649,6 @@ public function getUsersGroups(string $userId): DataResponse {
16561649
}
16571650

16581651
/**
1659-
* @NoSubAdminRequired
1660-
*
16611652
* Get a list of groups with details
16621653
*
16631654
* @param string $userId ID of the user
@@ -1667,6 +1658,7 @@ public function getUsersGroups(string $userId): DataResponse {
16671658
* 200: Users groups returned
16681659
*/
16691660
#[NoAdminRequired]
1661+
#[NoSubAdminRequired]
16701662
public function getUsersGroupsDetails(string $userId): DataResponse {
16711663
$loggedInUser = $this->userSession->getUser();
16721664

@@ -1733,8 +1725,6 @@ function (string $gid) {
17331725
}
17341726

17351727
/**
1736-
* @NoSubAdminRequired
1737-
*
17381728
* Get a list of the groups the user is a subadmin of, with details
17391729
*
17401730
* @param string $userId ID of the user
@@ -1744,6 +1734,7 @@ function (string $gid) {
17441734
* 200: Users subadmin groups returned
17451735
*/
17461736
#[NoAdminRequired]
1737+
#[NoSubAdminRequired]
17471738
public function getUserSubAdminGroupsDetails(string $userId): DataResponse {
17481739
$loggedInUser = $this->userSession->getUser();
17491740

‎apps/provisioning_api/lib/Controller/VerificationController.php‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
use OCP\AppFramework\Http\Attribute\BruteForceProtection;
1616
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
1717
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
18+
use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
1819
use OCP\AppFramework\Http\Attribute\OpenAPI;
1920
use OCP\AppFramework\Http\TemplateResponse;
2021
use OCP\HintException;
@@ -41,9 +42,7 @@ public function __construct(
4142
parent::__construct($appName, $request);
4243
}
4344

44-
/**
45-
* @NoSubAdminRequired
46-
*/
45+
#[NoSubAdminRequired]
4746
#[NoAdminRequired]
4847
#[NoCSRFRequired]
4948
public function showVerifyMail(string $token, string $userId, string $key): TemplateResponse {
@@ -71,9 +70,7 @@ public function showVerifyMail(string $token, string $userId, string $key): Temp
7170
], TemplateResponse::RENDER_AS_GUEST);
7271
}
7372

74-
/**
75-
* @NoSubAdminRequired
76-
*/
73+
#[NoSubAdminRequired]
7774
#[NoAdminRequired]
7875
#[BruteForceProtection(action: 'emailVerification')]
7976
public function verifyMail(string $token, string $userId, string $key): TemplateResponse {

‎apps/provisioning_api/lib/Middleware/ProvisioningApiMiddleware.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
use OCP\AppFramework\Controller;
1414
use OCP\AppFramework\Http;
1515
use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
16+
use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
1617
use OCP\AppFramework\Http\Response;
1718
use OCP\AppFramework\Middleware;
1819
use OCP\AppFramework\OCS\OCSException;
@@ -43,7 +44,8 @@ public function __construct(
4344
#[\Override]
4445
public function beforeController(Controller $controller, string $methodName): void {
4546
// If AuthorizedAdminSetting, the check will be done in the SecurityMiddleware
46-
if (!$this->isAdmin && !$this->reflector->hasAnnotation('NoSubAdminRequired') && !$this->isSubAdmin && !$this->reflector->hasAnnotationOrAttribute('AuthorizedAdminSetting', AuthorizedAdminSetting::class)) {
47+
if (!$this->isAdmin && !$this->reflector->hasAnnotationOrAttribute('NoSubAdminRequired', NoSubAdminRequired::class)
48+
&& !$this->isSubAdmin && !$this->reflector->hasAnnotationOrAttribute('AuthorizedAdminSetting', AuthorizedAdminSetting::class)) {
4749
throw new NotSubAdminException();
4850
}
4951
}

‎apps/provisioning_api/tests/Middleware/ProvisioningApiMiddlewareTest.php‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,11 @@ public function testBeforeController(bool $subadminRequired, bool $isAdmin, bool
5353
$isSubAdmin
5454
);
5555

56-
$this->reflector->method('hasAnnotation')
57-
->willReturnCallback(function ($annotation) use ($subadminRequired) {
56+
$this->reflector->method('hasAnnotationOrAttribute')
57+
->willReturnCallback(function ($annotation, $attribute) use ($subadminRequired, $hasSettingAuthorizationAnnotation) {
5858
if ($annotation === 'NoSubAdminRequired') {
5959
return !$subadminRequired;
6060
}
61-
return false;
62-
});
63-
$this->reflector->method('hasAnnotationOrAttribute')
64-
->willReturnCallback(function ($annotation, $attribute) use ($hasSettingAuthorizationAnnotation) {
6561
if ($annotation === 'AuthorizedAdminSetting') {
6662
return $hasSettingAuthorizationAnnotation;
6763
}

‎apps/settings/lib/Controller/AdminSettingsController.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
use OCP\AppFramework\Controller;
1111
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
1212
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
13+
use OCP\AppFramework\Http\Attribute\NoSubAdminRequired;
1314
use OCP\AppFramework\Http\Attribute\OpenAPI;
1415
use OCP\AppFramework\Http\TemplateResponse;
1516
use OCP\AppFramework\Services\IInitialState;
@@ -47,10 +48,10 @@ public function __construct(
4748
}
4849

4950
/**
50-
* @NoSubAdminRequired
5151
* We are checking the permissions in the getSettings method. If there is no allowed
5252
* settings for the given section. The user will be greeted by an error message.
5353
*/
54+
#[NoSubAdminRequired]
5455
#[NoAdminRequired]
5556
#[NoCSRFRequired]
5657
public function index(string $section): TemplateResponse {

0 commit comments

Comments
 (0)