MM-14441: restrict system admin config (#10477)
* tweak utils.Merge docs * move merge_test to utils_test package for easier testing * utils: support MergeConfig and StructFieldFilter * constrain updating certain fields by the restricted system admin
Этот коммит содержится в:
Jesse Hallam
коммит произвёл
GitHub
GitHub
родитель
3d92af2737
Коммит
8c8b1bbc9c
300
model/config.go
300
model/config.go
@@ -212,25 +212,25 @@ var ServerTLSSupportedCiphers = map[string]uint16{
|
||||
}
|
||||
|
||||
type ServiceSettings struct {
|
||||
SiteURL *string
|
||||
WebsocketURL *string
|
||||
LicenseFileLocation *string
|
||||
ListenAddress *string
|
||||
ConnectionSecurity *string
|
||||
TLSCertFile *string
|
||||
TLSKeyFile *string
|
||||
TLSMinVer *string
|
||||
TLSStrictTransport *bool
|
||||
TLSStrictTransportMaxAge *int64
|
||||
TLSOverwriteCiphers []string
|
||||
UseLetsEncrypt *bool
|
||||
LetsEncryptCertificateCacheFile *string
|
||||
Forward80To443 *bool
|
||||
ReadTimeout *int
|
||||
WriteTimeout *int
|
||||
MaximumLoginAttempts *int
|
||||
GoroutineHealthThreshold *int
|
||||
GoogleDeveloperKey *string
|
||||
SiteURL *string `restricted:"true"`
|
||||
WebsocketURL *string `restricted:"true"`
|
||||
LicenseFileLocation *string `restricted:"true"`
|
||||
ListenAddress *string `restricted:"true"`
|
||||
ConnectionSecurity *string `restricted:"true"`
|
||||
TLSCertFile *string `restricted:"true"`
|
||||
TLSKeyFile *string `restricted:"true"`
|
||||
TLSMinVer *string `restricted:"true"`
|
||||
TLSStrictTransport *bool `restricted:"true"`
|
||||
TLSStrictTransportMaxAge *int64 `restricted:"true"`
|
||||
TLSOverwriteCiphers []string `restricted:"true"`
|
||||
UseLetsEncrypt *bool `restricted:"true"`
|
||||
LetsEncryptCertificateCacheFile *string `restricted:"true"`
|
||||
Forward80To443 *bool `restricted:"true"`
|
||||
ReadTimeout *int `restricted:"true"`
|
||||
WriteTimeout *int `restricted:"true"`
|
||||
MaximumLoginAttempts *int `restricted:"true"`
|
||||
GoroutineHealthThreshold *int `restricted:"true"`
|
||||
GoogleDeveloperKey *string `restricted:"true"`
|
||||
EnableOAuthServiceProvider *bool
|
||||
EnableIncomingWebhooks *bool
|
||||
EnableOutgoingWebhooks *bool
|
||||
@@ -239,27 +239,27 @@ type ServiceSettings struct {
|
||||
EnablePostUsernameOverride *bool
|
||||
EnablePostIconOverride *bool
|
||||
EnableLinkPreviews *bool
|
||||
EnableTesting *bool
|
||||
EnableDeveloper *bool
|
||||
EnableSecurityFixAlert *bool
|
||||
EnableInsecureOutgoingConnections *bool
|
||||
AllowedUntrustedInternalConnections *string
|
||||
EnableTesting *bool `restricted:"true"`
|
||||
EnableDeveloper *bool `restricted:"true"`
|
||||
EnableSecurityFixAlert *bool `restricted:"true"`
|
||||
EnableInsecureOutgoingConnections *bool `restricted:"true"`
|
||||
AllowedUntrustedInternalConnections *string `restricted:"true"`
|
||||
EnableMultifactorAuthentication *bool
|
||||
EnforceMultifactorAuthentication *bool
|
||||
EnableUserAccessTokens *bool
|
||||
AllowCorsFrom *string
|
||||
CorsExposedHeaders *string
|
||||
CorsAllowCredentials *bool
|
||||
CorsDebug *bool
|
||||
AllowCookiesForSubdomains *bool
|
||||
SessionLengthWebInDays *int
|
||||
SessionLengthMobileInDays *int
|
||||
SessionLengthSSOInDays *int
|
||||
SessionCacheInMinutes *int
|
||||
SessionIdleTimeoutInMinutes *int
|
||||
WebsocketSecurePort *int
|
||||
WebsocketPort *int
|
||||
WebserverMode *string
|
||||
AllowCorsFrom *string `restricted:"true"`
|
||||
CorsExposedHeaders *string `restricted:"true"`
|
||||
CorsAllowCredentials *bool `restricted:"true"`
|
||||
CorsDebug *bool `restricted:"true"`
|
||||
AllowCookiesForSubdomains *bool `restricted:"true"`
|
||||
SessionLengthWebInDays *int `restricted:"true"`
|
||||
SessionLengthMobileInDays *int `restricted:"true"`
|
||||
SessionLengthSSOInDays *int `restricted:"true"`
|
||||
SessionCacheInMinutes *int `restricted:"true"`
|
||||
SessionIdleTimeoutInMinutes *int `restricted:"true"`
|
||||
WebsocketSecurePort *int `restricted:"true"`
|
||||
WebsocketPort *int `restricted:"true"`
|
||||
WebserverMode *string `restricted:"true"`
|
||||
EnableCustomEmoji *bool
|
||||
EnableEmojiPicker *bool
|
||||
EnableGifPicker *bool
|
||||
@@ -269,14 +269,14 @@ type ServiceSettings struct {
|
||||
DEPRECATED_DO_NOT_USE_RestrictPostDelete *string `json:"RestrictPostDelete"` // This field is deprecated and must not be used.
|
||||
DEPRECATED_DO_NOT_USE_AllowEditPost *string `json:"AllowEditPost"` // This field is deprecated and must not be used.
|
||||
PostEditTimeLimit *int
|
||||
TimeBetweenUserTypingUpdatesMilliseconds *int64
|
||||
EnablePostSearch *bool
|
||||
MinimumHashtagLength *int
|
||||
EnableUserTypingMessages *bool
|
||||
EnableChannelViewedMessages *bool
|
||||
EnableUserStatuses *bool
|
||||
ExperimentalEnableAuthenticationTransfer *bool
|
||||
ClusterLogTimeoutMilliseconds *int
|
||||
TimeBetweenUserTypingUpdatesMilliseconds *int64 `restricted:"true"`
|
||||
EnablePostSearch *bool `restricted:"true"`
|
||||
MinimumHashtagLength *int `restricted:"true"`
|
||||
EnableUserTypingMessages *bool `restricted:"true"`
|
||||
EnableChannelViewedMessages *bool `restricted:"true"`
|
||||
EnableUserStatuses *bool `restricted:"true"`
|
||||
ExperimentalEnableAuthenticationTransfer *bool `restricted:"true"`
|
||||
ClusterLogTimeoutMilliseconds *int `restricted:"true"`
|
||||
CloseUnusedDirectMessages *bool
|
||||
EnablePreviewFeatures *bool
|
||||
EnableTutorial *bool
|
||||
@@ -288,11 +288,11 @@ type ServiceSettings struct {
|
||||
DEPRECATED_DO_NOT_USE_ImageProxyOptions *string `json:"ImageProxyOptions" mapstructure:"ImageProxyOptions"` // This field is deprecated and must not be used.
|
||||
EnableAPITeamDeletion *bool
|
||||
ExperimentalEnableHardenedMode *bool
|
||||
DisableLegacyMFA *bool
|
||||
ExperimentalStrictCSRFEnforcement *bool
|
||||
DisableLegacyMFA *bool `restricted:"true"`
|
||||
ExperimentalStrictCSRFEnforcement *bool `restricted:"true"`
|
||||
EnableEmailInvitations *bool
|
||||
ExperimentalLdapGroupSync *bool
|
||||
DisableBotsWhenOwnerIsDeactivated *bool
|
||||
DisableBotsWhenOwnerIsDeactivated *bool `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *ServiceSettings) SetDefaults() {
|
||||
@@ -638,17 +638,17 @@ func (s *ServiceSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type ClusterSettings struct {
|
||||
Enable *bool
|
||||
ClusterName *string
|
||||
OverrideHostname *string
|
||||
UseIpAddress *bool
|
||||
UseExperimentalGossip *bool
|
||||
ReadOnlyConfig *bool
|
||||
GossipPort *int
|
||||
StreamingPort *int
|
||||
MaxIdleConns *int
|
||||
MaxIdleConnsPerHost *int
|
||||
IdleConnTimeoutMilliseconds *int
|
||||
Enable *bool `restricted:"true"`
|
||||
ClusterName *string `restricted:"true"`
|
||||
OverrideHostname *string `restricted:"true"`
|
||||
UseIpAddress *bool `restricted:"true"`
|
||||
UseExperimentalGossip *bool `restricted:"true"`
|
||||
ReadOnlyConfig *bool `restricted:"true"`
|
||||
GossipPort *int `restricted:"true"`
|
||||
StreamingPort *int `restricted:"true"`
|
||||
MaxIdleConns *int `restricted:"true"`
|
||||
MaxIdleConnsPerHost *int `restricted:"true"`
|
||||
IdleConnTimeoutMilliseconds *int `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *ClusterSettings) SetDefaults() {
|
||||
@@ -698,9 +698,9 @@ func (s *ClusterSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type MetricsSettings struct {
|
||||
Enable *bool
|
||||
BlockProfileRate *int
|
||||
ListenAddress *string
|
||||
Enable *bool `restricted:"true"`
|
||||
BlockProfileRate *int `restricted:"true"`
|
||||
ListenAddress *string `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *MetricsSettings) SetDefaults() {
|
||||
@@ -720,10 +720,10 @@ func (s *MetricsSettings) SetDefaults() {
|
||||
type ExperimentalSettings struct {
|
||||
ClientSideCertEnable *bool
|
||||
ClientSideCertCheck *string
|
||||
DisablePostMetadata *bool
|
||||
EnableClickToReply *bool
|
||||
LinkMetadataTimeoutMilliseconds *int64
|
||||
RestrictSystemAdmin *bool
|
||||
DisablePostMetadata *bool `restricted:"true"`
|
||||
EnableClickToReply *bool `restricted:"true"`
|
||||
LinkMetadataTimeoutMilliseconds *int64 `restricted:"true"`
|
||||
RestrictSystemAdmin *bool `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *ExperimentalSettings) SetDefaults() {
|
||||
@@ -753,7 +753,7 @@ func (s *ExperimentalSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type AnalyticsSettings struct {
|
||||
MaxUsersForStatistics *int
|
||||
MaxUsersForStatistics *int `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *AnalyticsSettings) SetDefaults() {
|
||||
@@ -803,16 +803,16 @@ func (s *SSOSettings) setDefaults() {
|
||||
}
|
||||
|
||||
type SqlSettings struct {
|
||||
DriverName *string
|
||||
DataSource *string
|
||||
DataSourceReplicas []string
|
||||
DataSourceSearchReplicas []string
|
||||
MaxIdleConns *int
|
||||
ConnMaxLifetimeMilliseconds *int
|
||||
MaxOpenConns *int
|
||||
Trace *bool
|
||||
AtRestEncryptKey *string
|
||||
QueryTimeout *int
|
||||
DriverName *string `restricted:"true"`
|
||||
DataSource *string `restricted:"true"`
|
||||
DataSourceReplicas []string `restricted:"true"`
|
||||
DataSourceSearchReplicas []string `restricted:"true"`
|
||||
MaxIdleConns *int `restricted:"true"`
|
||||
ConnMaxLifetimeMilliseconds *int `restricted:"true"`
|
||||
MaxOpenConns *int `restricted:"true"`
|
||||
Trace *bool `restricted:"true"`
|
||||
AtRestEncryptKey *string `restricted:"true"`
|
||||
QueryTimeout *int `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *SqlSettings) SetDefaults() {
|
||||
@@ -858,16 +858,16 @@ func (s *SqlSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type LogSettings struct {
|
||||
EnableConsole *bool
|
||||
ConsoleLevel *string
|
||||
ConsoleJson *bool
|
||||
EnableFile *bool
|
||||
FileLevel *string
|
||||
FileJson *bool
|
||||
FileFormat *string
|
||||
FileLocation *string
|
||||
EnableWebhookDebugging *bool
|
||||
EnableDiagnostics *bool
|
||||
EnableConsole *bool `restricted:"true"`
|
||||
ConsoleLevel *string `restricted:"true"`
|
||||
ConsoleJson *bool `restricted:"true"`
|
||||
EnableFile *bool `restricted:"true"`
|
||||
FileLevel *string `restricted:"true"`
|
||||
FileJson *bool `restricted:"true"`
|
||||
FileFormat *string `restricted:"true"`
|
||||
FileLocation *string `restricted:"true"`
|
||||
EnableWebhookDebugging *bool `restricted:"true"`
|
||||
EnableDiagnostics *bool `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *LogSettings) SetDefaults() {
|
||||
@@ -947,20 +947,20 @@ type FileSettings struct {
|
||||
EnableMobileUpload *bool
|
||||
EnableMobileDownload *bool
|
||||
MaxFileSize *int64
|
||||
DriverName *string
|
||||
Directory *string
|
||||
DriverName *string `restricted:"true"`
|
||||
Directory *string `restricted:"true"`
|
||||
EnablePublicLink *bool
|
||||
PublicLinkSalt *string
|
||||
InitialFont *string
|
||||
AmazonS3AccessKeyId *string
|
||||
AmazonS3SecretAccessKey *string
|
||||
AmazonS3Bucket *string
|
||||
AmazonS3Region *string
|
||||
AmazonS3Endpoint *string
|
||||
AmazonS3SSL *bool
|
||||
AmazonS3SignV2 *bool
|
||||
AmazonS3SSE *bool
|
||||
AmazonS3Trace *bool
|
||||
AmazonS3AccessKeyId *string `restricted:"true"`
|
||||
AmazonS3SecretAccessKey *string `restricted:"true"`
|
||||
AmazonS3Bucket *string `restricted:"true"`
|
||||
AmazonS3Region *string `restricted:"true"`
|
||||
AmazonS3Endpoint *string `restricted:"true"`
|
||||
AmazonS3SSL *bool `restricted:"true"`
|
||||
AmazonS3SignV2 *bool `restricted:"true"`
|
||||
AmazonS3SSE *bool `restricted:"true"`
|
||||
AmazonS3Trace *bool `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *FileSettings) SetDefaults() {
|
||||
@@ -1051,12 +1051,12 @@ type EmailSettings struct {
|
||||
FeedbackEmail *string
|
||||
ReplyToAddress *string
|
||||
FeedbackOrganization *string
|
||||
EnableSMTPAuth *bool
|
||||
SMTPUsername *string
|
||||
SMTPPassword *string
|
||||
SMTPServer *string
|
||||
SMTPPort *string
|
||||
ConnectionSecurity *string
|
||||
EnableSMTPAuth *bool `restricted:"true"`
|
||||
SMTPUsername *string `restricted:"true"`
|
||||
SMTPPassword *string `restricted:"true"`
|
||||
SMTPServer *string `restricted:"true"`
|
||||
SMTPPort *string `restricted:"true"`
|
||||
ConnectionSecurity *string `restricted:"true"`
|
||||
SendPushNotifications *bool
|
||||
PushNotificationServer *string
|
||||
PushNotificationContents *string
|
||||
@@ -1064,7 +1064,7 @@ type EmailSettings struct {
|
||||
EmailBatchingBufferSize *int
|
||||
EmailBatchingInterval *int
|
||||
EnablePreviewModeBanner *bool
|
||||
SkipServerCertificateVerification *bool
|
||||
SkipServerCertificateVerification *bool `restricted:"true"`
|
||||
EmailNotificationContentsType *string
|
||||
LoginButtonColor *string
|
||||
LoginButtonBorderColor *string
|
||||
@@ -1202,13 +1202,13 @@ func (s *EmailSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type RateLimitSettings struct {
|
||||
Enable *bool
|
||||
PerSec *int
|
||||
MaxBurst *int
|
||||
MemoryStoreSize *int
|
||||
VaryByRemoteAddr *bool
|
||||
VaryByUser *bool
|
||||
VaryByHeader string
|
||||
Enable *bool `restricted:"true"`
|
||||
PerSec *int `restricted:"true"`
|
||||
MaxBurst *int `restricted:"true"`
|
||||
MemoryStoreSize *int `restricted:"true"`
|
||||
VaryByRemoteAddr *bool `restricted:"true"`
|
||||
VaryByUser *bool `restricted:"true"`
|
||||
VaryByHeader string `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *RateLimitSettings) SetDefaults() {
|
||||
@@ -1253,11 +1253,11 @@ func (s *PrivacySettings) setDefaults() {
|
||||
}
|
||||
|
||||
type SupportSettings struct {
|
||||
TermsOfServiceLink *string
|
||||
PrivacyPolicyLink *string
|
||||
AboutLink *string
|
||||
HelpLink *string
|
||||
ReportAProblemLink *string
|
||||
TermsOfServiceLink *string `restricted:"true"`
|
||||
PrivacyPolicyLink *string `restricted:"true"`
|
||||
AboutLink *string `restricted:"true"`
|
||||
HelpLink *string `restricted:"true"`
|
||||
ReportAProblemLink *string `restricted:"true"`
|
||||
SupportEmail *string
|
||||
CustomTermsOfServiceEnabled *bool
|
||||
CustomTermsOfServiceReAcceptancePeriod *int
|
||||
@@ -1551,12 +1551,12 @@ func (s *TeamSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type ClientRequirements struct {
|
||||
AndroidLatestVersion string
|
||||
AndroidMinVersion string
|
||||
DesktopLatestVersion string
|
||||
DesktopMinVersion string
|
||||
IosLatestVersion string
|
||||
IosMinVersion string
|
||||
AndroidLatestVersion string `restricted:"true"`
|
||||
AndroidMinVersion string `restricted:"true"`
|
||||
DesktopLatestVersion string `restricted:"true"`
|
||||
DesktopMinVersion string `restricted:"true"`
|
||||
IosLatestVersion string `restricted:"true"`
|
||||
IosMinVersion string `restricted:"true"`
|
||||
}
|
||||
|
||||
type LdapSettings struct {
|
||||
@@ -1901,9 +1901,9 @@ func (s *SamlSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type NativeAppSettings struct {
|
||||
AppDownloadLink *string
|
||||
AndroidAppDownloadLink *string
|
||||
IosAppDownloadLink *string
|
||||
AppDownloadLink *string `restricted:"true"`
|
||||
AndroidAppDownloadLink *string `restricted:"true"`
|
||||
IosAppDownloadLink *string `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *NativeAppSettings) SetDefaults() {
|
||||
@@ -1921,25 +1921,25 @@ func (s *NativeAppSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type ElasticsearchSettings struct {
|
||||
ConnectionUrl *string
|
||||
Username *string
|
||||
Password *string
|
||||
EnableIndexing *bool
|
||||
EnableSearching *bool
|
||||
EnableAutocomplete *bool
|
||||
Sniff *bool
|
||||
PostIndexReplicas *int
|
||||
PostIndexShards *int
|
||||
ChannelIndexReplicas *int
|
||||
ChannelIndexShards *int
|
||||
UserIndexReplicas *int
|
||||
UserIndexShards *int
|
||||
AggregatePostsAfterDays *int
|
||||
PostsAggregatorJobStartTime *string
|
||||
IndexPrefix *string
|
||||
LiveIndexingBatchSize *int
|
||||
BulkIndexingTimeWindowSeconds *int
|
||||
RequestTimeoutSeconds *int
|
||||
ConnectionUrl *string `restricted:"true"`
|
||||
Username *string `restricted:"true"`
|
||||
Password *string `restricted:"true"`
|
||||
EnableIndexing *bool `restricted:"true"`
|
||||
EnableSearching *bool `restricted:"true"`
|
||||
EnableAutocomplete *bool `restricted:"true"`
|
||||
Sniff *bool `restricted:"true"`
|
||||
PostIndexReplicas *int `restricted:"true"`
|
||||
PostIndexShards *int `restricted:"true"`
|
||||
ChannelIndexReplicas *int `restricted:"true"`
|
||||
ChannelIndexShards *int `restricted:"true"`
|
||||
UserIndexReplicas *int `restricted:"true"`
|
||||
UserIndexShards *int `restricted:"true"`
|
||||
AggregatePostsAfterDays *int `restricted:"true"`
|
||||
PostsAggregatorJobStartTime *string `restricted:"true"`
|
||||
IndexPrefix *string `restricted:"true"`
|
||||
LiveIndexingBatchSize *int `restricted:"true"`
|
||||
BulkIndexingTimeWindowSeconds *int `restricted:"true"`
|
||||
RequestTimeoutSeconds *int `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *ElasticsearchSettings) SetDefaults() {
|
||||
@@ -2051,8 +2051,8 @@ func (s *DataRetentionSettings) SetDefaults() {
|
||||
}
|
||||
|
||||
type JobSettings struct {
|
||||
RunJobs *bool
|
||||
RunScheduler *bool
|
||||
RunJobs *bool `restricted:"true"`
|
||||
RunScheduler *bool `restricted:"true"`
|
||||
}
|
||||
|
||||
func (s *JobSettings) SetDefaults() {
|
||||
@@ -2071,9 +2071,9 @@ type PluginState struct {
|
||||
|
||||
type PluginSettings struct {
|
||||
Enable *bool
|
||||
EnableUploads *bool
|
||||
Directory *string
|
||||
ClientDirectory *string
|
||||
EnableUploads *bool `restricted:"true"`
|
||||
Directory *string `restricted:"true"`
|
||||
ClientDirectory *string `restricted:"true"`
|
||||
Plugins map[string]map[string]interface{}
|
||||
PluginStates map[string]*PluginState
|
||||
}
|
||||
|
||||
Ссылка в новой задаче
Block a user