1 files changed, 41 insertions, 2 deletions

diff --git a/apps/provisioning_api/lib/Controller/AppsController.php b/apps/provisioning_api/lib/Controller/AppsController.php
index 04dfd8f29b1..3f6cff7442a 100644
--- a/apps/provisioning_api/lib/Controller/AppsController.php
+++ b/apps/provisioning_api/lib/Controller/AppsController.php
@@ -8,6 +8,8 @@ declare(strict_types=1);
  */
 namespace OCA\Provisioning_API\Controller;
 
+use OC\App\AppStore\AppNotFoundException;
+use OC\Installer;
 use OC_App;
 use OCP\App\AppPathNotFoundException;
 use OCP\App\IAppManager;
@@ -16,6 +18,7 @@ use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCS\OCSException;
 use OCP\AppFramework\OCSController;
+use OCP\IAppConfig;
 use OCP\IRequest;
 
 class AppsController extends OCSController {
@@ -23,11 +26,24 @@ class AppsController extends OCSController {
 		string $appName,
 		IRequest $request,
 		private IAppManager $appManager,
+		private Installer $installer,
+		private IAppConfig $appConfig,
 	) {
 		parent::__construct($appName, $request);
 	}
 
 	/**
+	 * @throws \InvalidArgumentException
+	 */
+	protected function verifyAppId(string $app): string {
+		$cleanId = $this->appManager->cleanAppId($app);
+		if ($cleanId !== $app) {
+			throw new \InvalidArgumentException('Invalid app id given');
+		}
+		return $cleanId;
+	}
+
+	/**
 	 * Get a list of installed apps
 	 *
 	 * @param ?string $filter Filter for enabled or disabled apps
@@ -71,6 +87,11 @@ class AppsController extends OCSController {
 	 * 200: App info returned
 	 */
 	public function getAppInfo(string $app): DataResponse {
+		try {
+			$app = $this->verifyAppId($app);
+		} catch (\InvalidArgumentException $e) {
+			throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
+		}
 		$info = $this->appManager->getAppInfo($app);
 		if (!is_null($info)) {
 			return new DataResponse($info);
@@ -91,8 +112,20 @@ class AppsController extends OCSController {
 	#[PasswordConfirmationRequired]
 	public function enable(string $app): DataResponse {
 		try {
+			$app = $this->verifyAppId($app);
+
+			if (!$this->installer->isDownloaded($app)) {
+				$this->installer->downloadApp($app);
+			}
+
+			if ($this->appConfig->getValueString($app, 'installed_version', '') === '') {
+				$this->installer->installApp($app);
+			}
+
 			$this->appManager->enableApp($app);
-		} catch (AppPathNotFoundException $e) {
+		} catch (\InvalidArgumentException $e) {
+			throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
+		} catch (AppPathNotFoundException|AppNotFoundException $e) {
 			throw new OCSException('The request app was not found', OCSController::RESPOND_NOT_FOUND);
 		}
 		return new DataResponse();
@@ -103,12 +136,18 @@ class AppsController extends OCSController {
 	 *
 	 * @param string $app ID of the app
 	 * @return DataResponse<Http::STATUS_OK, list<empty>, array{}>
+	 * @throws OCSException
 	 *
 	 * 200: App disabled successfully
 	 */
 	#[PasswordConfirmationRequired]
 	public function disable(string $app): DataResponse {
-		$this->appManager->disableApp($app);
+		try {
+			$app = $this->verifyAppId($app);
+			$this->appManager->disableApp($app);
+		} catch (\InvalidArgumentException $e) {
+			throw new OCSException($e->getMessage(), OCSController::RESPOND_UNAUTHORISED);
+		}
 		return new DataResponse();
 	}
 }