MM-24440: Don't allow clearing the site url (#14694)

Summary
- If the site URL is set, don't allow clearing it.

Ticket Link
- https://mattermost.atlassian.net/browse/MM-24440

api4/config.go

@@ -79,6 +79,10 @@ func updateConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	appCfg := c.App.Config()
+	if *appCfg.ServiceSettings.SiteURL != "" && *cfg.ServiceSettings.SiteURL == "" {
+		c.Err = model.NewAppError("updateConfig", "api.config.update_config.clear_siteurl.app_error", nil, "", http.StatusBadRequest)
+		return
+	}
 	if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin {
 		// Start with the current configuration, and only merge values not marked as being
 		// restricted.
@@ -175,6 +179,10 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	appCfg := c.App.Config()
+	if *appCfg.ServiceSettings.SiteURL != "" && *cfg.ServiceSettings.SiteURL == "" {
+		c.Err = model.NewAppError("patchConfig", "api.config.update_config.clear_siteurl.app_error", nil, "", http.StatusBadRequest)
+		return
+	}
 	var filterFn utils.StructFieldFilter
 	if *appCfg.ExperimentalSettings.RestrictSystemAdmin {
 		filterFn = func(structField reflect.StructField, base, patch reflect.Value) bool {

api4/config_test.go

@@ -153,6 +153,29 @@ func TestUpdateConfig(t *testing.T) {
 			assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)
 		})
 	})
+
+	t.Run("System Admin should not be able to clear Site URL", func(t *testing.T) {
+		siteURL := cfg.ServiceSettings.SiteURL
+		defer th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.SiteURL = siteURL })
+
+		nonEmptyURL := "http://localhost"
+		cfg.ServiceSettings.SiteURL = &nonEmptyURL
+
+		// Set the SiteURL
+		cfg, resp = th.SystemAdminClient.UpdateConfig(cfg)
+		CheckNoError(t, resp)
+		require.Equal(t, nonEmptyURL, *cfg.ServiceSettings.SiteURL)
+
+		// Check that the Site URL can't be cleared
+		cfg.ServiceSettings.SiteURL = sToP("")
+		cfg, resp = th.SystemAdminClient.UpdateConfig(cfg)
+		CheckBadRequestStatus(t, resp)
+		CheckErrorMessage(t, resp, "api.config.update_config.clear_siteurl.app_error")
+		// Check that the Site URL wasn't cleared
+		cfg, resp = th.SystemAdminClient.GetConfig()
+		CheckNoError(t, resp)
+		require.Equal(t, nonEmptyURL, *cfg.ServiceSettings.SiteURL)
+	})
 }
 
 func TestUpdateConfigMessageExportSpecialHandling(t *testing.T) {
@@ -494,4 +517,37 @@ func TestPatchConfig(t *testing.T) {
 			assert.Equal(t, false, *updatedConfig.PluginSettings.EnableUploads)
 		})
 	})
+
+	t.Run("System Admin should not be able to clear Site URL", func(t *testing.T) {
+		cfg, resp := th.SystemAdminClient.GetConfig()
+		CheckNoError(t, resp)
+		siteURL := cfg.ServiceSettings.SiteURL
+		defer th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.SiteURL = siteURL })
+
+		// Set the SiteURL
+		nonEmptyURL := "http://localhost"
+		config := model.Config{
+			ServiceSettings: model.ServiceSettings{
+				SiteURL: model.NewString(nonEmptyURL),
+			},
+		}
+		updatedConfig, resp := th.SystemAdminClient.PatchConfig(&config)
+		CheckNoError(t, resp)
+		require.Equal(t, nonEmptyURL, *updatedConfig.ServiceSettings.SiteURL)
+
+		// Check that the Site URL can't be cleared
+		config = model.Config{
+			ServiceSettings: model.ServiceSettings{
+				SiteURL: model.NewString(""),
+			},
+		}
+		updatedConfig, resp = th.SystemAdminClient.PatchConfig(&config)
+		CheckBadRequestStatus(t, resp)
+		CheckErrorMessage(t, resp, "api.config.update_config.clear_siteurl.app_error")
+
+		// Check that the Site URL wasn't cleared
+		cfg, resp = th.SystemAdminClient.GetConfig()
+		CheckNoError(t, resp)
+		require.Equal(t, nonEmptyURL, *cfg.ServiceSettings.SiteURL)
+	})
 }

i18n/en.json

@@ -1114,6 +1114,10 @@
     "id": "api.config.client.old_format.app_error",
     "translation": "New format for the client configuration is not supported yet. Please specify format=old in the query string."
   },
+  {
+    "id": "api.config.update_config.clear_siteurl.app_error",
+    "translation": "Site URL cannot be cleared."
+  },
   {
     "id": "api.config.update_config.restricted_merge.app_error",
     "translation": "Failed to merge given config."