Disable signatures modification through API (#13682)

Co-authored-by: mattermod <mattermod@users.noreply.github.com>

api4/config.go

@@ -82,6 +82,9 @@ func updateConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 	// Do not allow plugin uploads to be toggled through the API
 	cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads
 
+	// Do not allow certificates to be changed through the API
+	cfg.PluginSettings.SignaturePublicKeyFiles = appCfg.PluginSettings.SignaturePublicKeyFiles
+
 	c.App.HandleMessageExportConfig(cfg, appCfg)
 
 	err := cfg.IsValid()

api4/config_test.go

@@ -128,6 +128,22 @@ func TestUpdateConfig(t *testing.T) {
 		assert.Equal(t, oldEnableUploads, *cfg.PluginSettings.EnableUploads)
 		assert.Equal(t, oldEnableUploads, *th.App.Config().PluginSettings.EnableUploads)
 	})
+
+	t.Run("Should not be able to modify PluginSettings.SignaturePublicKeyFiles", func(t *testing.T) {
+		oldPublicKeys := th.App.Config().PluginSettings.SignaturePublicKeyFiles
+		cfg.PluginSettings.SignaturePublicKeyFiles = append(cfg.PluginSettings.SignaturePublicKeyFiles, "new_signature")
+
+		cfg, resp = th.SystemAdminClient.UpdateConfig(cfg)
+		CheckNoError(t, resp)
+		assert.Equal(t, oldPublicKeys, cfg.PluginSettings.SignaturePublicKeyFiles)
+		assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)
+
+		cfg.PluginSettings.SignaturePublicKeyFiles = nil
+		cfg, resp = th.SystemAdminClient.UpdateConfig(cfg)
+		CheckNoError(t, resp)
+		assert.Equal(t, oldPublicKeys, cfg.PluginSettings.SignaturePublicKeyFiles)
+		assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)
+	})
 }
 
 func TestUpdateConfigMessageExportSpecialHandling(t *testing.T) {