diff --git a/api4/config.go b/api4/config.go index 728b6e2640..c1c644122f 100644 --- a/api4/config.go +++ b/api4/config.go @@ -79,6 +79,10 @@ func updateConfig(c *Context, w http.ResponseWriter, r *http.Request) { } appCfg := c.App.Config() + if *appCfg.ServiceSettings.SiteURL != "" && *cfg.ServiceSettings.SiteURL == "" { + c.Err = model.NewAppError("updateConfig", "api.config.update_config.clear_siteurl.app_error", nil, "", http.StatusBadRequest) + return + } if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin { // Start with the current configuration, and only merge values not marked as being // restricted. @@ -175,6 +179,10 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) { } appCfg := c.App.Config() + if *appCfg.ServiceSettings.SiteURL != "" && *cfg.ServiceSettings.SiteURL == "" { + c.Err = model.NewAppError("patchConfig", "api.config.update_config.clear_siteurl.app_error", nil, "", http.StatusBadRequest) + return + } var filterFn utils.StructFieldFilter if *appCfg.ExperimentalSettings.RestrictSystemAdmin { filterFn = func(structField reflect.StructField, base, patch reflect.Value) bool { diff --git a/api4/config_test.go b/api4/config_test.go index 76b888d70b..6407c62d62 100644 --- a/api4/config_test.go +++ b/api4/config_test.go @@ -153,6 +153,29 @@ func TestUpdateConfig(t *testing.T) { assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles) }) }) + + t.Run("System Admin should not be able to clear Site URL", func(t *testing.T) { + siteURL := cfg.ServiceSettings.SiteURL + defer th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.SiteURL = siteURL }) + + nonEmptyURL := "http://localhost" + cfg.ServiceSettings.SiteURL = &nonEmptyURL + + // Set the SiteURL + cfg, resp = th.SystemAdminClient.UpdateConfig(cfg) + CheckNoError(t, resp) + require.Equal(t, nonEmptyURL, *cfg.ServiceSettings.SiteURL) + + // Check that the Site URL can't be cleared + cfg.ServiceSettings.SiteURL = sToP("") + cfg, resp = th.SystemAdminClient.UpdateConfig(cfg) + CheckBadRequestStatus(t, resp) + CheckErrorMessage(t, resp, "api.config.update_config.clear_siteurl.app_error") + // Check that the Site URL wasn't cleared + cfg, resp = th.SystemAdminClient.GetConfig() + CheckNoError(t, resp) + require.Equal(t, nonEmptyURL, *cfg.ServiceSettings.SiteURL) + }) } func TestUpdateConfigMessageExportSpecialHandling(t *testing.T) { @@ -494,4 +517,37 @@ func TestPatchConfig(t *testing.T) { assert.Equal(t, false, *updatedConfig.PluginSettings.EnableUploads) }) }) + + t.Run("System Admin should not be able to clear Site URL", func(t *testing.T) { + cfg, resp := th.SystemAdminClient.GetConfig() + CheckNoError(t, resp) + siteURL := cfg.ServiceSettings.SiteURL + defer th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.SiteURL = siteURL }) + + // Set the SiteURL + nonEmptyURL := "http://localhost" + config := model.Config{ + ServiceSettings: model.ServiceSettings{ + SiteURL: model.NewString(nonEmptyURL), + }, + } + updatedConfig, resp := th.SystemAdminClient.PatchConfig(&config) + CheckNoError(t, resp) + require.Equal(t, nonEmptyURL, *updatedConfig.ServiceSettings.SiteURL) + + // Check that the Site URL can't be cleared + config = model.Config{ + ServiceSettings: model.ServiceSettings{ + SiteURL: model.NewString(""), + }, + } + updatedConfig, resp = th.SystemAdminClient.PatchConfig(&config) + CheckBadRequestStatus(t, resp) + CheckErrorMessage(t, resp, "api.config.update_config.clear_siteurl.app_error") + + // Check that the Site URL wasn't cleared + cfg, resp = th.SystemAdminClient.GetConfig() + CheckNoError(t, resp) + require.Equal(t, nonEmptyURL, *cfg.ServiceSettings.SiteURL) + }) } diff --git a/i18n/en.json b/i18n/en.json index 8459b909b4..52ddb4c6b9 100644 --- a/i18n/en.json +++ b/i18n/en.json @@ -1114,6 +1114,10 @@ "id": "api.config.client.old_format.app_error", "translation": "New format for the client configuration is not supported yet. Please specify format=old in the query string." }, + { + "id": "api.config.update_config.clear_siteurl.app_error", + "translation": "Site URL cannot be cleared." + }, { "id": "api.config.update_config.restricted_merge.app_error", "translation": "Failed to merge given config."