Merge pull request #61875 from nextcloud/backport/61845/stable33

[stable33] fix(DeclarativeManager): Fix admin delegation

Author: AndyScherzinger

lib/private/Settings/DeclarativeManager.php

@@ -142,8 +142,10 @@ public function getFormsWithValues(IUser $user, ?string $type, ?string $section)
 				if ($section !== null && $schema['section_id'] !== $section) {
 					continue;
 				}
-				// If listing all fields skip the admin fields which a non-admin user has no access to
-				if ($type === null && $schema['section_type'] === 'admin' && !$isAdmin) {
+				// Skip admin declarative forms for non-admin users. They have no access to
+				// these fields even when they are allowed to view the section through admin
+				// delegation, which only covers non-declarative settings.
+				if ($schema['section_type'] === DeclarativeSettingsTypes::SECTION_TYPE_ADMIN && !$isAdmin) {
 					continue;
 				}
 

tests/lib/Settings/DeclarativeManagerTest.php

@@ -555,8 +555,15 @@ public function testAdminFormUserUnauthorized(): void {
 		$schema = self::validSchemaAllFields;
 		$this->declarativeManager->registerSchema($app, $schema);
 
+		// A non-admin user must not receive admin declarative forms, but this must not
+		// throw: it would abort rendering of a section a user can legitimately access
+		// through admin delegation (which only covers non-declarative settings).
+		$forms = $this->declarativeManager->getFormsWithValues($this->user, $schema['section_type'], $schema['section_id']);
+		$this->assertEmpty($forms);
+
+		// Writing to an admin declarative form is still forbidden for a non-admin user.
 		$this->expectException(\Exception::class);
-		$this->declarativeManager->getFormsWithValues($this->user, $schema['section_type'], $schema['section_id']);
+		$this->declarativeManager->setValue($this->user, $app, $schema['id'], 'some_real_setting', '120m');
 	}
 
 	/**