upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-11 09:42:09 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 40

feat(config): Add sysadmin level encription.available config

Browse source 
This is important because a user who has admin permissions who is not a sysadmin
might enable encryption without knowing the full implications, the sysadmin
should be able to prevent this.

Signed-off-by: nfebe <fenn25.fn@gmail.com>
This commit is contained in:
nfebe 2024-11-11 16:31:25 +01:00
parent 016738f5be
commit c84e30d36a
3 changed files with 24 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
apps/settings/lib/Settings/Admin/Security.php
View file

@ -9,6 +9,7 @@ use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
use OCP\AppFramework\Http\TemplateResponse;
use OCP\AppFramework\Services\IInitialState;
use OCP\Encryption\IManager;
use OCP\IConfig;
use OCP\IURLGenerator;
use OCP\IUserManager;
use OCP\Settings\ISettings;
@ -22,6 +23,7 @@ class Security implements ISettings {
MandatoryTwoFactor $mandatoryTwoFactor,
private IInitialState $initialState,
private IURLGenerator $urlGenerator,
private IConfig $config,
) {
$this->mandatoryTwoFactor = $mandatoryTwoFactor;
}
@ -43,6 +45,7 @@ class Security implements ISettings {
$this->initialState->provideInitialState('mandatory2FAState', $this->mandatoryTwoFactor->getState());
$this->initialState->provideInitialState('two-factor-admin-doc', $this->urlGenerator->linkToDocs('admin-2fa'));
$this->initialState->provideInitialState('encryption-available', $this->config->getSystemValue('encryption.available', true));
$this->initialState->provideInitialState('encryption-enabled', $this->manager->isEnabled());
$this->initialState->provideInitialState('encryption-ready', $this->manager->isReady());
$this->initialState->provideInitialState('external-backends-enabled', count($this->userManager->getBackends()) > 1);

18
apps/settings/src/components/Encryption.vue
View file

@ -99,6 +99,7 @@ export default {
logger.debug('No encryption module loaded or enabled')
}
return {
encryptionIsAvailable: loadState('settings', 'encryption-available', false),
encryptionReady: loadState('settings', 'encryption-ready', false),
encryptionEnabled: loadState('settings', 'encryption-enabled', false),
externalBackendsEnabled: loadState('settings', 'external-backends-enabled'),
@ -112,12 +113,15 @@ export default {
},
methods: {
displayWarning() {
if (encryptionIsAvailable) {
this.encryptionEnabledToggleEffect()
showError(t('settings', 'File encryption is not allowed by system administrator.'))
logger.debug('File encryption is not allowed by system administrator.')
return
}
if (!this.hasEncryptionModules || !this.encryptionReady) {
this.encryptionEnabled = true
this.encryptionEnabledToggleEffect()
showError(t('settings', 'Encryption is not ready, please enable an encryption module/app.'))
setTimeout(() => {
this.encryptionEnabled = false
}, 1000)
return
}
if (!this.encryptionEnabled) {
@ -127,6 +131,12 @@ export default {
this.shouldDisplayWarning = false
}
},
encryptionEnabledToggleEffect() {
this.encryptionEnabled = true
setTimeout(() => {
this.encryptionEnabled = false
}, 1000)
},
async update(key, value) {
await confirmPassword()

7
config/config.sample.php
View file

@ -2589,4 +2589,11 @@ $CONFIG = [
* Defaults to 5.
*/
'files.chunked_upload.max_parallel_count' => 5,
/**
* Allow server-side encryption.
*
* Default is true, indicating that encryption is available or permitted by the system administrator.
*/
'encryption.available' => true,
];