Skip to content

Commit ca148d6

Browse files
committed
fix(provisioning_api): Allow group details access for users with admin delegation
This fixes an issue where users with "Administration privileges → Users" could not access the groups details endpoint in the provisioning API, resulting in a 403 Forbidden error. There is a problem with adding the `AuthorizedAdminSetting` attribute (middleware) that only allows access to users with Sharing admin privileges. Users with "`Users` admin" privileges should also be able to access group details. Resolves: #52617 Signed-off-by: nfebe <fenn25.fn@gmail.com>
1 parent b54803b commit ca148d6

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

apps/provisioning_api/lib/Controller/GroupsController.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,18 @@ public function getGroups(string $search = '', ?int $limit = null, int $offset =
9797
* 200: Groups details returned
9898
*/
9999
#[NoAdminRequired]
100-
#[AuthorizedAdminSetting(settings: Sharing::class)]
101100
public function getGroupsDetails(string $search = '', ?int $limit = null, int $offset = 0): DataResponse {
101+
$currentUser = $this->userSession->getUser();
102+
if ($currentUser === null) {
103+
throw new OCSForbiddenException('Not logged in');
104+
}
105+
106+
$isAdmin = $this->groupManager->isAdmin($currentUser->getUID());
107+
$isDelegatedAdmin = $this->groupManager->isDelegatedAdmin($currentUser->getUID());
108+
109+
if (!$isAdmin && !$isDelegatedAdmin) {
110+
throw new OCSForbiddenException('Logged in user must be an admin or delegated admin');
111+
}
102112
$groups = $this->groupManager->search($search, $limit, $offset);
103113
$groups = array_values(array_map(function ($group) {
104114
/** @var IGroup $group */

0 commit comments

Comments
 (0)