Skip to content

Commit 18d5ded

Browse files
provokateurinprovokateurin
authored
Merge pull request #58002 from nextcloud/fix/let-user-backend-lock-fields
feat: Allow user backends to manage property permissions
2 parents 08e1d9b + 51ccc8a commit 18d5ded

15 files changed

Lines changed: 231 additions & 256 deletions

File tree

‎apps/provisioning_api/lib/Controller/UsersController.php‎

Lines changed: 27 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -770,32 +770,19 @@ public function getEditableFieldsForUser(string $userId): DataResponse {
770770
$targetUser = $currentLoggedInUser;
771771
}
772772

773-
$allowDisplayNameChange = $this->config->getSystemValue('allow_user_to_change_display_name', true);
774-
if ($allowDisplayNameChange === true && (
775-
$targetUser->getBackend() instanceof ISetDisplayNameBackend
776-
|| $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
777-
)) {
778-
$permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
779-
}
780-
781-
// Fallback to display name value to avoid changing behavior with the new option.
782-
if ($this->config->getSystemValue('allow_user_to_change_email', $allowDisplayNameChange)) {
783-
$permittedFields[] = IAccountManager::PROPERTY_EMAIL;
784-
}
785-
786-
$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
787-
$permittedFields[] = IAccountManager::PROPERTY_PHONE;
788-
$permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
789-
$permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
790-
$permittedFields[] = IAccountManager::PROPERTY_TWITTER;
791-
$permittedFields[] = IAccountManager::PROPERTY_BLUESKY;
792-
$permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
793-
$permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
794-
$permittedFields[] = IAccountManager::PROPERTY_ROLE;
795-
$permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
796-
$permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
797-
$permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
798-
$permittedFields[] = IAccountManager::PROPERTY_PRONOUNS;
773+
foreach (IAccountManager::ALLOWED_PROPERTIES as $property) {
774+
if ($property === IAccountManager::PROPERTY_AVATAR) {
775+
continue;
776+
}
777+
if (!$targetUser->canEditProperty($property)) {
778+
continue;
779+
}
780+
$permittedFields[] = $property;
781+
}
782+
783+
if ($targetUser->canEditProperty(IAccountManager::COLLECTION_EMAIL)) {
784+
$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
785+
}
799786

800787
return new DataResponse($permittedFields);
801788
}
@@ -841,7 +828,9 @@ public function editUserMultiValue(
841828
$permittedFields = [];
842829
if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
843830
// Editing self (display, email)
844-
$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
831+
if ($targetUser->canEditProperty(IAccountManager::COLLECTION_EMAIL)) {
832+
$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
833+
}
845834
$permittedFields[] = IAccountManager::COLLECTION_EMAIL . self::SCOPE_SUFFIX;
846835
} else {
847836
// Check if admin / subadmin
@@ -933,23 +922,10 @@ public function editUser(string $userId, string $key, string $value): DataRespon
933922

934923
$permittedFields = [];
935924
if ($targetUser->getUID() === $currentLoggedInUser->getUID()) {
936-
$allowDisplayNameChange = $this->config->getSystemValue('allow_user_to_change_display_name', true);
937-
if ($allowDisplayNameChange !== false && (
938-
$targetUser->getBackend() instanceof ISetDisplayNameBackend
939-
|| $targetUser->getBackend()->implementsActions(Backend::SET_DISPLAYNAME)
940-
)) {
925+
if ($targetUser->canChangeDisplayName()) {
941926
$permittedFields[] = self::USER_FIELD_DISPLAYNAME;
942-
$permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME;
943-
}
944-
945-
// Fallback to display name value to avoid changing behavior with the new option.
946-
if ($this->config->getSystemValue('allow_user_to_change_email', $allowDisplayNameChange)) {
947-
$permittedFields[] = IAccountManager::PROPERTY_EMAIL;
948927
}
949928

950-
$permittedFields[] = IAccountManager::PROPERTY_DISPLAYNAME . self::SCOPE_SUFFIX;
951-
$permittedFields[] = IAccountManager::PROPERTY_EMAIL . self::SCOPE_SUFFIX;
952-
953929
$permittedFields[] = IAccountManager::COLLECTION_EMAIL;
954930

955931
$permittedFields[] = self::USER_FIELD_PASSWORD;
@@ -972,34 +948,16 @@ public function editUser(string $userId, string $key, string $value): DataRespon
972948
$permittedFields[] = self::USER_FIELD_FIRST_DAY_OF_WEEK;
973949
}
974950

975-
$permittedFields[] = IAccountManager::PROPERTY_PHONE;
976-
$permittedFields[] = IAccountManager::PROPERTY_ADDRESS;
977-
$permittedFields[] = IAccountManager::PROPERTY_WEBSITE;
978-
$permittedFields[] = IAccountManager::PROPERTY_TWITTER;
979-
$permittedFields[] = IAccountManager::PROPERTY_BLUESKY;
980-
$permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE;
981-
$permittedFields[] = IAccountManager::PROPERTY_ORGANISATION;
982-
$permittedFields[] = IAccountManager::PROPERTY_ROLE;
983-
$permittedFields[] = IAccountManager::PROPERTY_HEADLINE;
984-
$permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY;
985-
$permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED;
986-
$permittedFields[] = IAccountManager::PROPERTY_BIRTHDATE;
987-
$permittedFields[] = IAccountManager::PROPERTY_PRONOUNS;
988-
989-
$permittedFields[] = IAccountManager::PROPERTY_PHONE . self::SCOPE_SUFFIX;
990-
$permittedFields[] = IAccountManager::PROPERTY_ADDRESS . self::SCOPE_SUFFIX;
991-
$permittedFields[] = IAccountManager::PROPERTY_WEBSITE . self::SCOPE_SUFFIX;
992-
$permittedFields[] = IAccountManager::PROPERTY_TWITTER . self::SCOPE_SUFFIX;
993-
$permittedFields[] = IAccountManager::PROPERTY_BLUESKY . self::SCOPE_SUFFIX;
994-
$permittedFields[] = IAccountManager::PROPERTY_FEDIVERSE . self::SCOPE_SUFFIX;
995-
$permittedFields[] = IAccountManager::PROPERTY_ORGANISATION . self::SCOPE_SUFFIX;
996-
$permittedFields[] = IAccountManager::PROPERTY_ROLE . self::SCOPE_SUFFIX;
997-
$permittedFields[] = IAccountManager::PROPERTY_HEADLINE . self::SCOPE_SUFFIX;
998-
$permittedFields[] = IAccountManager::PROPERTY_BIOGRAPHY . self::SCOPE_SUFFIX;
999-
$permittedFields[] = IAccountManager::PROPERTY_PROFILE_ENABLED . self::SCOPE_SUFFIX;
1000-
$permittedFields[] = IAccountManager::PROPERTY_BIRTHDATE . self::SCOPE_SUFFIX;
1001-
$permittedFields[] = IAccountManager::PROPERTY_AVATAR . self::SCOPE_SUFFIX;
1002-
$permittedFields[] = IAccountManager::PROPERTY_PRONOUNS . self::SCOPE_SUFFIX;
951+
foreach (IAccountManager::ALLOWED_PROPERTIES as $property) {
952+
$permittedFields[] = $property . self::SCOPE_SUFFIX;
953+
if ($property === IAccountManager::PROPERTY_AVATAR) {
954+
continue;
955+
}
956+
if (!$targetUser->canEditProperty($property)) {
957+
continue;
958+
}
959+
$permittedFields[] = $property;
960+
}
1003961

1004962
// If admin they can edit their own quota and manager
1005963
$isAdmin = $this->groupManager->isAdmin($currentLoggedInUser->getUID());

0 commit comments

Comments
 (0)