diff options
author | Christoph Wurst <christoph@winzerhof-wurst.at> | 2019-05-22 10:48:51 +0200 |
---|---|---|
committer | Christoph Wurst <christoph@winzerhof-wurst.at> | 2019-05-23 20:31:40 +0200 |
commit | 22ae6828237a516b1cd36a3dad623b8046dfd76a (patch) | |
tree | c00361d0747e295f98e1e089114b8bf48bcc0e57 /lib | |
parent | 09974ae92d6f3bc20143dab43baef9fc75139585 (diff) | |
download | nextcloud-server-22ae6828237a516b1cd36a3dad623b8046dfd76a.tar.gz nextcloud-server-22ae6828237a516b1cd36a3dad623b8046dfd76a.zip |
Make it possible to show admin settings for sub admins
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
Diffstat (limited to 'lib')
-rw-r--r-- | lib/composer/composer/autoload_classmap.php | 1 | ||||
-rw-r--r-- | lib/composer/composer/autoload_static.php | 1 | ||||
-rw-r--r-- | lib/private/AppFramework/DependencyInjection/DIContainer.php | 2 | ||||
-rw-r--r-- | lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php | 13 | ||||
-rw-r--r-- | lib/private/Settings/Manager.php | 49 | ||||
-rw-r--r-- | lib/public/Settings/IManager.php | 3 | ||||
-rw-r--r-- | lib/public/Settings/ISubAdminSettings.php | 35 |
7 files changed, 92 insertions, 12 deletions
diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php index d9dd418ce08..2bbce469fc0 100644 --- a/lib/composer/composer/autoload_classmap.php +++ b/lib/composer/composer/autoload_classmap.php @@ -379,6 +379,7 @@ return array( 'OCP\\Settings\\IManager' => $baseDir . '/lib/public/Settings/IManager.php', 'OCP\\Settings\\ISection' => $baseDir . '/lib/public/Settings/ISection.php', 'OCP\\Settings\\ISettings' => $baseDir . '/lib/public/Settings/ISettings.php', + 'OCP\\Settings\\ISubAdminSettings' => $baseDir . '/lib/public/Settings/ISubAdminSettings.php', 'OCP\\Share' => $baseDir . '/lib/public/Share.php', 'OCP\\Share\\Exceptions\\GenericShareException' => $baseDir . '/lib/public/Share/Exceptions/GenericShareException.php', 'OCP\\Share\\Exceptions\\IllegalIDChangeException' => $baseDir . '/lib/public/Share/Exceptions/IllegalIDChangeException.php', diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php index d9693ab0320..383af9f3a77 100644 --- a/lib/composer/composer/autoload_static.php +++ b/lib/composer/composer/autoload_static.php @@ -409,6 +409,7 @@ class ComposerStaticInit53792487c5a8370acc0b06b1a864ff4c 'OCP\\Settings\\IManager' => __DIR__ . '/../../..' . '/lib/public/Settings/IManager.php', 'OCP\\Settings\\ISection' => __DIR__ . '/../../..' . '/lib/public/Settings/ISection.php', 'OCP\\Settings\\ISettings' => __DIR__ . '/../../..' . '/lib/public/Settings/ISettings.php', + 'OCP\\Settings\\ISubAdminSettings' => __DIR__ . '/../../..' . '/lib/public/Settings/ISubAdminSettings.php', 'OCP\\Share' => __DIR__ . '/../../..' . '/lib/public/Share.php', 'OCP\\Share\\Exceptions\\GenericShareException' => __DIR__ . '/../../..' . '/lib/public/Share/Exceptions/GenericShareException.php', 'OCP\\Share\\Exceptions\\IllegalIDChangeException' => __DIR__ . '/../../..' . '/lib/public/Share/Exceptions/IllegalIDChangeException.php', diff --git a/lib/private/AppFramework/DependencyInjection/DIContainer.php b/lib/private/AppFramework/DependencyInjection/DIContainer.php index 209ea5c876d..a6a9b205747 100644 --- a/lib/private/AppFramework/DependencyInjection/DIContainer.php +++ b/lib/private/AppFramework/DependencyInjection/DIContainer.php @@ -56,6 +56,7 @@ use OCP\AppFramework\Utility\ITimeFactory; use OCP\Files\Folder; use OCP\Files\IAppData; use OCP\GlobalScale\IConfig; +use OCP\Group\ISubAdmin; use OCP\IL10N; use OCP\ILogger; use OCP\INavigationManager; @@ -218,6 +219,7 @@ class DIContainer extends SimpleContainer implements IAppContainer { $c['AppName'], $server->getUserSession()->isLoggedIn(), $server->getGroupManager()->isAdmin($this->getUserId()), + $server->getUserSession()->getUser() !== null && $server->query(ISubAdmin::class)->isSubAdmin($server->getUserSession()->getUser()), $server->getContentSecurityPolicyManager(), $server->getCsrfTokenManager(), $server->getContentSecurityPolicyNonceManager(), diff --git a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php index 87954ccc1cb..fef3f226e15 100644 --- a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php @@ -82,6 +82,8 @@ class SecurityMiddleware extends Middleware { private $isLoggedIn; /** @var bool */ private $isAdminUser; + /** @var bool */ + private $isSubAdmin; /** @var ContentSecurityPolicyManager */ private $contentSecurityPolicyManager; /** @var CsrfTokenManager */ @@ -101,6 +103,7 @@ class SecurityMiddleware extends Middleware { string $appName, bool $isLoggedIn, bool $isAdminUser, + bool $isSubAdmin, ContentSecurityPolicyManager $contentSecurityPolicyManager, CsrfTokenManager $csrfTokenManager, ContentSecurityPolicyNonceManager $cspNonceManager, @@ -115,6 +118,7 @@ class SecurityMiddleware extends Middleware { $this->logger = $logger; $this->isLoggedIn = $isLoggedIn; $this->isAdminUser = $isAdminUser; + $this->isSubAdmin = $isSubAdmin; $this->contentSecurityPolicyManager = $contentSecurityPolicyManager; $this->csrfTokenManager = $csrfTokenManager; $this->cspNonceManager = $cspNonceManager; @@ -143,7 +147,14 @@ class SecurityMiddleware extends Middleware { throw new NotLoggedInException(); } - if(!$this->reflector->hasAnnotation('NoAdminRequired') && !$this->isAdminUser) { + if($this->reflector->hasAnnotation('SubAdminRequired') + && !$this->isSubAdmin + && !$this->isAdminUser) { + throw new NotAdminException($this->l10n->t('Logged in user must be an admin or sub admin')); + } + if(!$this->reflector->hasAnnotation('SubAdminRequired') + && !$this->reflector->hasAnnotation('NoAdminRequired') + && !$this->isAdminUser) { throw new NotAdminException($this->l10n->t('Logged in user must be an admin')); } } diff --git a/lib/private/Settings/Manager.php b/lib/private/Settings/Manager.php index 982c2dba2ee..7e3edfa9df0 100644 --- a/lib/private/Settings/Manager.php +++ b/lib/private/Settings/Manager.php @@ -29,6 +29,7 @@ namespace OC\Settings; +use Closure; use OCP\AppFramework\QueryException; use OCP\IL10N; use OCP\ILogger; @@ -38,6 +39,7 @@ use OCP\L10N\IFactory; use OCP\Settings\ISettings; use OCP\Settings\IManager; use OCP\Settings\ISection; +use OCP\Settings\ISubAdminSettings; class Manager implements IManager { @@ -150,10 +152,11 @@ class Manager implements IManager { /** * @param string $type 'admin' or 'personal' * @param string $section + * @param Closure $filter optional filter to apply on all loaded ISettings * * @return ISettings[] */ - protected function getSettings(string $type, string $section): array { + protected function getSettings(string $type, string $section, Closure $filter = null): array { if (!isset($this->settings[$type])) { $this->settings[$type] = []; } @@ -162,6 +165,10 @@ class Manager implements IManager { } foreach ($this->settingClasses as $class => $settingsType) { + if ($type !== $settingsType) { + continue; + } + try { /** @var ISettings $setting */ $setting = \OC::$server->query($class); @@ -175,6 +182,9 @@ class Manager implements IManager { continue; } + if ($filter !== null && !$filter($setting)) { + continue; + } if ($setting->getSection() === null) { continue; } @@ -226,33 +236,44 @@ class Manager implements IManager { /** * @param string $section + * @param Closure $filter * * @return ISection[] */ - private function getBuiltInAdminSettings($section): array { + private function getBuiltInAdminSettings($section, Closure $filter = null): array { $forms = []; if ($section === 'overview') { /** @var ISettings $form */ $form = $this->container->query(Admin\Overview::class); - $forms[$form->getPriority()] = [$form]; + if ($filter === null || $filter($form)) { + $forms[$form->getPriority()] = [$form]; + } } if ($section === 'server') { /** @var ISettings $form */ $form = $this->container->query(Admin\Server::class); - $forms[$form->getPriority()] = [$form]; + if ($filter === null || $filter($form)) { + $forms[$form->getPriority()] = [$form]; + } $form = $this->container->query(Admin\Mail::class); - $forms[$form->getPriority()] = [$form]; + if ($filter === null || $filter($form)) { + $forms[$form->getPriority()] = [$form]; + } } if ($section === 'security') { /** @var ISettings $form */ $form = $this->container->query(Admin\Security::class); - $forms[$form->getPriority()] = [$form]; + if ($filter === null || $filter($form)) { + $forms[$form->getPriority()] = [$form]; + } } if ($section === 'sharing') { /** @var ISettings $form */ $form = $this->container->query(Admin\Sharing::class); - $forms[$form->getPriority()] = [$form]; + if ($filter === null || $filter($form)) { + $forms[$form->getPriority()] = [$form]; + } } return $forms; @@ -290,9 +311,17 @@ class Manager implements IManager { /** * @inheritdoc */ - public function getAdminSettings($section): array { - $settings = $this->getBuiltInAdminSettings($section); - $appSettings = $this->getSettings('admin', $section); + public function getAdminSettings($section, bool $subAdminOnly = false): array { + if ($subAdminOnly) { + $subAdminSettingsFilter = function(ISettings $settings) { + return $settings instanceof ISubAdminSettings; + }; + $settings = $this->getBuiltInAdminSettings($section, $subAdminSettingsFilter); + $appSettings = $this->getSettings('admin', $section, $subAdminSettingsFilter); + } else { + $settings = $this->getBuiltInAdminSettings($section); + $appSettings = $this->getSettings('admin', $section); + } foreach ($appSettings as $setting) { if (!isset($settings[$setting->getPriority()])) { diff --git a/lib/public/Settings/IManager.php b/lib/public/Settings/IManager.php index 52f12c3a8fb..c0a34f4403f 100644 --- a/lib/public/Settings/IManager.php +++ b/lib/public/Settings/IManager.php @@ -82,10 +82,11 @@ interface IManager { * returns a list of the admin settings * * @param string $section the section id for which to load the settings + * @param bool $subAdminOnly only return settings sub admins are supposed to see (since 17.0.0) * @return array array of IAdmin[] where key is the priority * @since 9.1.0 */ - public function getAdminSettings($section): array; + public function getAdminSettings($section, bool $subAdminOnly = false): array; /** * returns a list of the personal settings diff --git a/lib/public/Settings/ISubAdminSettings.php b/lib/public/Settings/ISubAdminSettings.php new file mode 100644 index 00000000000..3d047d2c872 --- /dev/null +++ b/lib/public/Settings/ISubAdminSettings.php @@ -0,0 +1,35 @@ +<?php + +declare(strict_types=1); + +/** + * @copyright 2019 Christoph Wurst <christoph@winzerhof-wurst.at> + * + * @author 2019 Christoph Wurst <christoph@winzerhof-wurst.at> + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +namespace OCP\Settings; + +/** + * Tagging interface for settings that should be shown to sub admins + * + * @since 17.0.0 + */ +interface ISubAdminSettings extends ISettings { + +} |