Skip to content

Commit

Permalink
fix: allows admin to edit global credentials
Browse files Browse the repository at this point in the history
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
  • Loading branch information
Altahrim committed Jun 24, 2024
1 parent 4680bc4 commit e93866f
Showing 1 changed file with 9 additions and 3 deletions.
12 changes: 9 additions & 3 deletions apps/files_external/lib/Controller/AjaxController.php
Original file line number Diff line number Diff line change
Expand Up @@ -84,15 +84,21 @@ public function getSshKeys($keyLength = 1024) {
*/
public function saveGlobalCredentials($uid, $user, $password) {
$currentUser = $this->userSession->getUser();
if ($currentUser === null) {
return false;
}

// Non-admins can only edit their own credentials
$allowedToEdit = ($currentUser->getUID() === $uid);
// Admin can edit global credentials
$allowedToEdit = $uid === ''
? $this->groupManager->isAdmin($currentUser->getUID())
: $currentUser->getUID() === $uid;

if ($allowedToEdit) {
$this->globalAuth->saveAuth($uid, $user, $password);
return true;
} else {
return false;
}

return false;
}
}

0 comments on commit e93866f

Please sign in to comment.