Skip to content

Commit ed051b0

Browse files
committed
fix: require admin permissions for all systemtag updates
Signed-off-by: Robin Appelman <robin@icewind.nl>
1 parent e68d903 commit ed051b0

1 file changed

Lines changed: 2 additions & 10 deletions

File tree

apps/dav/lib/SystemTag/SystemTagNode.php

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -101,18 +101,10 @@ public function update($name, $userVisible, $userAssignable, $color): void {
101101
if (!$this->tagManager->canUserSeeTag($this->tag, $this->user)) {
102102
throw new NotFound('Tag with id ' . $this->tag->getId() . ' does not exist');
103103
}
104-
if (!$this->tagManager->canUserAssignTag($this->tag, $this->user)) {
105-
throw new Forbidden('No permission to update tag ' . $this->tag->getId());
106-
}
107104

108-
// only admin is able to change permissions, regular users can only rename
105+
// only admin is able to update system tags
109106
if (!$this->isAdmin) {
110-
// only renaming is allowed for regular users
111-
if ($userVisible !== $this->tag->isUserVisible()
112-
|| $userAssignable !== $this->tag->isUserAssignable()
113-
) {
114-
throw new Forbidden('No permission to update permissions for tag ' . $this->tag->getId());
115-
}
107+
throw new Forbidden('No permission to update tag ' . $this->tag->getId());
116108
}
117109

118110
// Make sure color is a proper hex

0 commit comments

Comments
 (0)