From 11c6d07d6adc6279a883ed842c11e7aca46c978b Mon Sep 17 00:00:00 2001 From: Ibrahim Serdar Acikgoz Date: Wed, 20 Jan 2021 14:45:21 +0300 Subject: [PATCH] [MM-31404] api4/config: return error when patching PluginSettings.EnableUploads (#16611) * api4/config: return error when patching PluginSettings.EnableUploads * reflect review comments Co-authored-by: Mattermod --- api4/config.go | 5 ++++- api4/config_local.go | 3 --- api4/config_test.go | 10 +++++++--- i18n/en.json | 4 ++++ 4 files changed, 15 insertions(+), 7 deletions(-) diff --git a/api4/config.go b/api4/config.go index ac03bbe9d8..7f9e9d56a2 100644 --- a/api4/config.go +++ b/api4/config.go @@ -228,7 +228,10 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) { } // Do not allow plugin uploads to be toggled through the API - cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads + if cfg.PluginSettings.EnableUploads != nil && *cfg.PluginSettings.EnableUploads != *appCfg.PluginSettings.EnableUploads { + c.Err = model.NewAppError("patchConfig", "api.config.update_config.not_allowed_security.app_error", map[string]interface{}{"Name": "PluginSettings.EnableUploads"}, "", http.StatusForbidden) + return + } if cfg.MessageExportSettings.EnableExport != nil { c.App.HandleMessageExportConfig(cfg, appCfg) diff --git a/api4/config_local.go b/api4/config_local.go index 4f4d42b87d..360f95a0a1 100644 --- a/api4/config_local.go +++ b/api4/config_local.go @@ -87,9 +87,6 @@ func localPatchConfig(c *Context, w http.ResponseWriter, r *http.Request) { return true } - // Do not allow plugin uploads to be toggled through the API - cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads - if cfg.MessageExportSettings.EnableExport != nil { c.App.HandleMessageExportConfig(cfg, appCfg) } diff --git a/api4/config_test.go b/api4/config_test.go index 23945760dd..e6c305e9e6 100644 --- a/api4/config_test.go +++ b/api4/config_test.go @@ -633,9 +633,13 @@ func TestPatchConfig(t *testing.T) { EnableUploads: model.NewBool(true), }} - updatedConfig, _ := client.PatchConfig(&config) - - assert.Equal(t, false, *updatedConfig.PluginSettings.EnableUploads) + updatedConfig, resp := client.PatchConfig(&config) + if client == th.LocalClient { + CheckOKStatus(t, resp) + assert.Equal(t, true, *updatedConfig.PluginSettings.EnableUploads) + } else { + CheckForbiddenStatus(t, resp) + } }) }) diff --git a/i18n/en.json b/i18n/en.json index 39adc8cec8..0ba67d7a4e 100644 --- a/i18n/en.json +++ b/i18n/en.json @@ -1142,6 +1142,10 @@ "id": "api.config.update_config.clear_siteurl.app_error", "translation": "Site URL cannot be cleared." }, + { + "id": "api.config.update_config.not_allowed_security.app_error", + "translation": "Changing {{.Name}} is not allowed due to security reasons." + }, { "id": "api.config.update_config.restricted_merge.app_error", "translation": "Failed to merge given config."