Skip to content

Commit 6b2bd29

Browse files
committed
fix: require admin permissions for all systemtag updates
Signed-off-by: Robin Appelman <robin@icewind.nl>
1 parent 8fbe27a commit 6b2bd29

1 file changed

Lines changed: 2 additions & 10 deletions

File tree

apps/dav/lib/SystemTag/SystemTagNode.php

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -98,18 +98,10 @@ public function update($name, $userVisible, $userAssignable, $color): void {
9898
if (!$this->tagManager->canUserSeeTag($this->tag, $this->user)) {
9999
throw new NotFound('Tag with id ' . $this->tag->getId() . ' does not exist');
100100
}
101-
if (!$this->tagManager->canUserAssignTag($this->tag, $this->user)) {
102-
throw new Forbidden('No permission to update tag ' . $this->tag->getId());
103-
}
104101

105-
// only admin is able to change permissions, regular users can only rename
102+
// only admin is able to update system tags
106103
if (!$this->isAdmin) {
107-
// only renaming is allowed for regular users
108-
if ($userVisible !== $this->tag->isUserVisible()
109-
|| $userAssignable !== $this->tag->isUserAssignable()
110-
) {
111-
throw new Forbidden('No permission to update permissions for tag ' . $this->tag->getId());
112-
}
104+
throw new Forbidden('No permission to update tag ' . $this->tag->getId());
113105
}
114106

115107
// Make sure color is a proper hex

0 commit comments

Comments
 (0)