Add option to disallow creation of local storages

PVince81 · PVince81 · commit 3847d98c56ef · 2021-12-06T12:23:26.000+01:00
Introduce a new config option to prevent web UI admins to create
or edit external storages of type "local".

Signed-off-by: Vincent Petry &lt;vincent@nextcloud.com&gt;
diff --git a/apps/files_external/js/settings.js b/apps/files_external/js/settings.js
@@ -659,6 +659,7 @@ MountConfigListView.prototype = _.extend({
 		}
 
 		this._encryptionEnabled = options.encryptionEnabled;
+		this._canCreateLocal = options.canCreateLocal;
 
 		// read the backend config that was carefully crammed
 		// into the data-configurations attribute of the select
@@ -793,6 +794,7 @@ MountConfigListView.prototype = _.extend({
 	newStorage: function(storageConfig, onCompletion) {
 		var mountPoint = storageConfig.mountPoint;
 		var backend = this._allBackends[storageConfig.backend];
+		var readOnly = false;
 
 		if (!backend) {
 			backend = {
@@ -801,6 +803,11 @@ MountConfigListView.prototype = _.extend({
 			};
 		}
 
+		console.log(backend, this._canCreateLocal);
+		if (backend.identifier === 'local' && !this._canCreateLocal) {
+			readOnly = true;
+		}
+
 		// FIXME: Replace with a proper Handlebar template
 		var $tr = this.$el.find('tr#addMountPoint');
 		this.$el.find('tbody').append($tr.clone());
@@ -825,10 +832,13 @@ MountConfigListView.prototype = _.extend({
 		$tr.addClass(backend.identifier);
 		$tr.find('.backend').data('identifier', backend.identifier);
 
-		if (backend.invalid) {
+		if (backend.invalid || readOnly) {
 			$tr.find('[name=mountPoint]').prop('disabled', true);
 			$tr.find('.applicable,.mountOptionsToggle').empty();
-			this.updateStatus($tr, false, 'Unknown backend: ' + backend.name);
+			$tr.find('.save').empty();
+			if (backend.invalid) {
+				this.updateStatus($tr, false, 'Unknown backend: ' + backend.name);
+			}
 			return $tr;
 		}
 
@@ -970,6 +980,7 @@ MountConfigListView.prototype = _.extend({
 					var storageConfig = new self._storageConfigClass();
 					_.extend(storageConfig, storageParams);
 					var $tr = self.newStorage(storageConfig, onCompletion);
+
 					self.recheckStorageConfig($tr);
 				});
 				onCompletion.resolve();
@@ -1313,9 +1324,11 @@ MountConfigListView.prototype = _.extend({
 
 window.addEventListener('DOMContentLoaded', function() {
 	var enabled = $('#files_external').attr('data-encryption-enabled');
+	var canCreateLocal = $('#files_external').attr('data-can-create-local');
 	var encryptionEnabled = (enabled ==='true')? true: false;
 	var mountConfigListView = new MountConfigListView($('#externalStorage'), {
-		encryptionEnabled: encryptionEnabled
+		encryptionEnabled: encryptionEnabled,
+		canCreateLocal: (canCreateLocal === 'true') ? true: false,
 	});
 	mountConfigListView.loadStorages();
 
diff --git a/apps/files_external/lib/Controller/GlobalStoragesController.php b/apps/files_external/lib/Controller/GlobalStoragesController.php
@@ -31,6 +31,7 @@
 use OCA\Files_External\Service\GlobalStoragesService;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataResponse;
+use OCP\IConfig;
 use OCP\IGroupManager;
 use OCP\IL10N;
 use OCP\ILogger;
@@ -51,6 +52,7 @@ class GlobalStoragesController extends StoragesController {
 	 * @param ILogger $logger
 	 * @param IUserSession $userSession
 	 * @param IGroupManager $groupManager
+	 * @param IConfig $config
 	 */
 	public function __construct(
 		$AppName,
@@ -59,7 +61,8 @@ public function __construct(
 		GlobalStoragesService $globalStoragesService,
 		ILogger $logger,
 		IUserSession $userSession,
-		IGroupManager $groupManager
+		IGroupManager $groupManager,
+		IConfig $config
 	) {
 		parent::__construct(
 			$AppName,
@@ -68,7 +71,8 @@ public function __construct(
 			$globalStoragesService,
 			$logger,
 			$userSession,
-			$groupManager
+			$groupManager,
+			$config
 		);
 	}
 
@@ -96,6 +100,14 @@ public function create(
 		$applicableGroups,
 		$priority
 	) {
+		$canCreateNewLocalStorage = $this->config->getSystemValue('files_external_allow_create_new_local', false);
+		if (!$canCreateNewLocalStorage && $backend === 'local') {
+			return new DataResponse(
+				null,
+				Http::STATUS_FORBIDDEN
+			);
+		}
+
 		$newStorage = $this->createStorage(
 			$mountPoint,
 			$backend,
diff --git a/apps/files_external/lib/Controller/StoragesController.php b/apps/files_external/lib/Controller/StoragesController.php
@@ -39,6 +39,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\Files\StorageNotAvailableException;
+use OCP\IConfig;
 use OCP\IGroupManager;
 use OCP\IL10N;
 use OCP\ILogger;
@@ -79,6 +80,11 @@ abstract class StoragesController extends Controller {
 	 */
 	protected $groupManager;
 
+	/**
+	 * @var IConfig
+	 */
+	protected $config;
+
 	/**
 	 * Creates a new storages controller.
 	 *
@@ -95,14 +101,16 @@ public function __construct(
 		StoragesService $storagesService,
 		ILogger $logger,
 		IUserSession $userSession,
-		IGroupManager $groupManager
+		IGroupManager $groupManager,
+		IConfig $config
 	) {
 		parent::__construct($AppName, $request);
 		$this->l10n = $l10n;
 		$this->service = $storagesService;
 		$this->logger = $logger;
 		$this->userSession = $userSession;
 		$this->groupManager = $groupManager;
+		$this->config = $config;
 	}
 
 	/**
@@ -129,6 +137,14 @@ protected function createStorage(
 		$applicableGroups = null,
 		$priority = null
 	) {
+		$canCreateNewLocalStorage = $this->config->getSystemValue('files_external_allow_create_new_local', false);
+		if (!$canCreateNewLocalStorage && $backend === 'local') {
+			return new DataResponse(
+				null,
+				Http::STATUS_FORBIDDEN
+			);
+		}
+
 		try {
 			return $this->service->createStorage(
 				$mountPoint,
diff --git a/apps/files_external/lib/Controller/UserGlobalStoragesController.php b/apps/files_external/lib/Controller/UserGlobalStoragesController.php
@@ -36,6 +36,7 @@
 use OCA\Files_External\Service\UserGlobalStoragesService;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataResponse;
+use OCP\IConfig;
 use OCP\IGroupManager;
 use OCP\IL10N;
 use OCP\ILogger;
@@ -64,7 +65,8 @@ public function __construct(
 		UserGlobalStoragesService $userGlobalStoragesService,
 		ILogger $logger,
 		IUserSession $userSession,
-		IGroupManager $groupManager
+		IGroupManager $groupManager,
+		IConfig $config
 	) {
 		parent::__construct(
 			$AppName,
@@ -73,7 +75,8 @@ public function __construct(
 			$userGlobalStoragesService,
 			$logger,
 			$userSession,
-			$groupManager
+			$groupManager,
+			$config
 		);
 	}
 
diff --git a/apps/files_external/lib/Controller/UserStoragesController.php b/apps/files_external/lib/Controller/UserStoragesController.php
@@ -35,6 +35,7 @@
 use OCA\Files_External\Service\UserStoragesService;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataResponse;
+use OCP\IConfig;
 use OCP\IGroupManager;
 use OCP\IL10N;
 use OCP\ILogger;
@@ -63,7 +64,8 @@ public function __construct(
 		UserStoragesService $userStoragesService,
 		ILogger $logger,
 		IUserSession $userSession,
-		IGroupManager $groupManager
+		IGroupManager $groupManager,
+		IConfig $config
 	) {
 		parent::__construct(
 			$AppName,
@@ -72,7 +74,8 @@ public function __construct(
 			$userStoragesService,
 			$logger,
 			$userSession,
-			$groupManager
+			$groupManager,
+			$config
 		);
 	}
 
@@ -127,6 +130,13 @@ public function create(
 		$backendOptions,
 		$mountOptions
 	) {
+		$canCreateNewLocalStorage = $this->config->getSystemValue('files_external_allow_create_new_local', false);
+		if (!$canCreateNewLocalStorage && $backend === 'local') {
+			return new DataResponse(
+				null,
+				Http::STATUS_FORBIDDEN
+			);
+		}
 		$newStorage = $this->createStorage(
 			$mountPoint,
 			$backend,
diff --git a/apps/files_external/templates/settings.php b/apps/files_external/templates/settings.php
@@ -100,7 +100,10 @@ function writeParameterInput($parameter, $options, $classes = []) {
 	<h2><?php p($l->t('No external storage configured or you don\'t have the permission to configure them')); ?></h2>
 </div>
 
-<form data-can-create="<?php echo $canCreateMounts?'true':'false' ?>" id="files_external" class="section" data-encryption-enabled="<?php echo $_['encryptionEnabled']?'true': 'false'; ?>">
+<?php
+	$canCreateNewLocalStorage = \OC::$server->getConfig()->getSystemValue('files_external_allow_create_new_local', false);
+?>
+<form data-can-create="<?php echo $canCreateMounts?'true':'false' ?>" data-can-create-local="<?php echo $canCreateNewLocalStorage?'true':'false' ?>" id="files_external" class="section" data-encryption-enabled="<?php echo $_['encryptionEnabled']?'true': 'false'; ?>">
 	<h2 class="inlineblock" data-anchor-name="external-storage"><?php p($l->t('External storage')); ?></h2>
 	<a target="_blank" rel="noreferrer" class="icon-info" title="<?php p($l->t('Open documentation'));?>" href="<?php p(link_to_docs('admin-external-storage')); ?>"></a>
 	<p class="settings-hint"><?php p($l->t('External storage enables you to mount external storage services and devices as secondary Nextcloud storage devices. You may also allow users to mount their own external storage services.')); ?></p>
@@ -150,7 +153,7 @@ function writeParameterInput($parameter, $options, $classes = []) {
 							});
 						?>
 						<?php foreach ($sortedBackends as $backend): ?>
-							<?php if ($backend->getDeprecateTo()) {
+							<?php if ($backend->getDeprecateTo() || (!$canCreateNewLocalStorage && $backend->getIdentifier() == "local")) {
 							continue;
 						} // ignore deprecated backends?>
 							<option value="<?php p($backend->getIdentifier()); ?>"><?php p($backend->getText()); ?></option>
diff --git a/apps/files_external/tests/Controller/StoragesControllerTest.php b/apps/files_external/tests/Controller/StoragesControllerTest.php
@@ -50,10 +50,12 @@ abstract class StoragesControllerTest extends \Test\TestCase {
 
 	protected function setUp(): void {
 		\OCA\Files_External\MountConfig::$skipTest = true;
+		\OC::$server->getSystemConfig()->setValue('files_external_allow_create_new_local', true);
 	}
 
 	protected function tearDown(): void {
 		\OCA\Files_External\MountConfig::$skipTest = false;
+		\OC::$server->getSystemConfig()->setValue('files_external_allow_create_new_local', false);
 	}
 
 	/**
@@ -130,6 +132,49 @@ public function testAddStorage() {
 		$this->assertEquals($storageConfig, $data);
 	}
 
+	public function testAddStorageWithoutConfig() {
+		\OC::$server->getSystemConfig()->setValue('files_external_allow_create_new_local', false);
+
+		$authMech = $this->getAuthMechMock();
+		$authMech->method('validateStorage')
+			->willReturn(true);
+		$authMech->method('isVisibleFor')
+			->willReturn(true);
+		$backend = $this->getBackendMock();
+		$backend->method('validateStorage')
+			->willReturn(true);
+		$backend->method('isVisibleFor')
+			->willReturn(true);
+
+		$storageConfig = new StorageConfig(1);
+		$storageConfig->setMountPoint('mount');
+		$storageConfig->setBackend($backend);
+		$storageConfig->setAuthMechanism($authMech);
+		$storageConfig->setBackendOptions([]);
+
+		$this->service->expects($this->never())
+			->method('createStorage')
+			->will($this->returnValue($storageConfig));
+		$this->service->expects($this->never())
+			->method('addStorage')
+			->will($this->returnValue($storageConfig));
+
+		$response = $this->controller->create(
+			'mount',
+			'\OCA\Files_External\Lib\Storage\SMB',
+			'\OCA\Files_External\Lib\Auth\NullMechanism',
+			[],
+			[],
+			[],
+			[],
+			null
+		);
+
+		$data = $response->getData();
+		$this->assertEquals(Http::STATUS_FORBIDDEN, $response->getStatus());
+		$this->assertEquals(null, $data);
+	}
+
 	public function testUpdateStorage() {
 		$authMech = $this->getAuthMechMock();
 		$authMech->method('validateStorage')
diff --git a/config/config.sample.php b/config/config.sample.php
@@ -1746,6 +1746,17 @@
  */
 'external_storage.auth_availability_delay' => 1800,
 
+/**
+ * Allows to create external storages of type "Local" in the web interface and APIs.
+ *
+ * It is still possible to create local storages with occ using the following command:
+ * % php occ files_external:create /mountpoint local null::null -c datadir=/path/to/data
+ *
+ * Defaults to ``false``
+ *
+ */
+'files_external_allow_create_new_local' => false,
+
 /**
  * Specifies how often the local filesystem (the Nextcloud data/ directory, and
  * NFS mounts in data/) is checked for changes made outside Nextcloud. This
