Lukas Reschke
becde58952
Otherwise an administrator could bypass sudo mode by installing an app that allows RCE by design. I've by intention excluded the update endpoint from the requirement because updating apps should be as unintruisive as possible. Not the cleanest approach by adding this to the AJAX endpoints instead of requiring a controller but for 11 this felt safer for me. We can clean this up together later then. (also the other AJAX endpoints in this folder do have the same logic) Ref https://github.com/nextcloud/server/issues/2487 Signed-off-by: Lukas Reschke <lukas@statuscode.ch> |
7 лет назад | |
---|---|---|
.. | ||
disableapp.php | Add sudo mode to enabling and disabling apps | 7 лет назад |
enableapp.php | Add sudo mode to enabling and disabling apps | 7 лет назад |
installapp.php | Add sudo mode to enabling and disabling apps | 7 лет назад |
navigationdetect.php | Update with robin | 8 лет назад |
setquota.php | Require password confirmation to change the Quota | 7 лет назад |
togglegroups.php | Require password confirmation for user management | 7 лет назад |
togglesubadmins.php | Require password confirmation for user management | 7 лет назад |
uninstallapp.php | Add sudo mode to enabling and disabling apps | 7 лет назад |
updateapp.php | Add update support | 7 лет назад |