upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

Merge pull request #60556 from nextcloud/backport/60543/stable32

Browse source 
[stable32] fix: only allow full admins to create 'token needed' webhooks
This commit is contained in:
Stephan Orbaugh 2026-05-20 16:37:54 +02:00 committed by GitHub
commit 7722b5689b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
apps/webhook_listeners/lib/Controller/WebhooksController.php
View file

@ -26,8 +26,10 @@ use OCP\AppFramework\OCS\OCSException;
use OCP\AppFramework\OCS\OCSForbiddenException;
use OCP\AppFramework\OCS\OCSNotFoundException;
use OCP\AppFramework\OCSController;
use OCP\IGroupManager;
use OCP\IRequest;
use OCP\ISession;
use OCP\IUserSession;
use Psr\Log\LoggerInterface;
/**
@ -42,6 +44,8 @@ class WebhooksController extends OCSController {
private WebhookListenerMapper $mapper,
private ?string $userId,
private ISession $session,
private IUserSession $userSession,
private IGroupManager $groupManager,
) {
parent::__construct($appName, $request);
}
@ -144,6 +148,12 @@ class WebhooksController extends OCSController {
} catch (\ValueError $e) {
throw new OCSBadRequestException('This auth method does not exist');
}
$user = $this->userSession->getUser();
if (!$user || !$this->groupManager->isAdmin($user->getUID())) {
$tokenNeeded = null;
}
try {
$webhookListener = $this->mapper->addWebhookListener(
$appId,