upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

fix: only allow full admins to create 'token needed' webhooks

Browse source 
Signed-off-by: Robin Appelman <robin@icewind.nl>
This commit is contained in:
Robin Appelman 2026-05-08 18:36:46 +02:00 committed by backportbot[bot]
parent a2eb38fefc
commit 910d13ce62
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
apps/webhook_listeners/lib/Controller/WebhooksController.php
View file

@ -26,8 +26,10 @@ use OCP\AppFramework\OCS\OCSException;
use OCP\AppFramework\OCS\OCSForbiddenException;
use OCP\AppFramework\OCS\OCSNotFoundException;
use OCP\AppFramework\OCSController;
use OCP\IGroupManager;
use OCP\IRequest;
use OCP\ISession;
use OCP\IUserSession;
use Psr\Log\LoggerInterface;
/**
@ -42,6 +44,8 @@ class WebhooksController extends OCSController {
private WebhookListenerMapper $mapper,
private ?string $userId,
private ISession $session,
private IUserSession $userSession,
private IGroupManager $groupManager,
) {
parent::__construct($appName, $request);
}
@ -144,6 +148,12 @@ class WebhooksController extends OCSController {
} catch (\ValueError $e) {
throw new OCSBadRequestException('This auth method does not exist');
}
$user = $this->userSession->getUser();
if (!$user || !$this->groupManager->isAdmin($user->getUID())) {
$tokenNeeded = null;
}
try {
$webhookListener = $this->mapper->addWebhookListener(
$appId,