[MM-31404] api4/config: return error when patching PluginSettings.EnableUploads (#16611)

* api4/config: return error when patching PluginSettings.EnableUploads

* reflect review comments

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/config.go

@@ -228,7 +228,10 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Do not allow plugin uploads to be toggled through the API
-	cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads
+	if cfg.PluginSettings.EnableUploads != nil && *cfg.PluginSettings.EnableUploads != *appCfg.PluginSettings.EnableUploads {
+		c.Err = model.NewAppError("patchConfig", "api.config.update_config.not_allowed_security.app_error", map[string]interface{}{"Name": "PluginSettings.EnableUploads"}, "", http.StatusForbidden)
+		return
+	}
 
 	if cfg.MessageExportSettings.EnableExport != nil {
 		c.App.HandleMessageExportConfig(cfg, appCfg)

api4/config_local.go

@@ -87,9 +87,6 @@ func localPatchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 		return true
 	}
 
-	// Do not allow plugin uploads to be toggled through the API
-	cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads
-
 	if cfg.MessageExportSettings.EnableExport != nil {
 		c.App.HandleMessageExportConfig(cfg, appCfg)
 	}

api4/config_test.go

@@ -633,9 +633,13 @@ func TestPatchConfig(t *testing.T) {
 				EnableUploads: model.NewBool(true),
 			}}
 
-			updatedConfig, _ := client.PatchConfig(&config)
-
-			assert.Equal(t, false, *updatedConfig.PluginSettings.EnableUploads)
+			updatedConfig, resp := client.PatchConfig(&config)
+			if client == th.LocalClient {
+				CheckOKStatus(t, resp)
+				assert.Equal(t, true, *updatedConfig.PluginSettings.EnableUploads)
+			} else {
+				CheckForbiddenStatus(t, resp)
+			}
 		})
 	})
 

i18n/en.json

@@ -1142,6 +1142,10 @@
     "id": "api.config.update_config.clear_siteurl.app_error",
     "translation": "Site URL cannot be cleared."
   },
+  {
+    "id": "api.config.update_config.not_allowed_security.app_error",
+    "translation": "Changing {{.Name}} is not allowed due to security reasons."
+  },
   {
     "id": "api.config.update_config.restricted_merge.app_error",
     "translation": "Failed to merge given config."