Skip to content

fix(provisioning_api): Allow group details access for users with admin delegation - #53275

Merged
nfebe merged 1 commit into
masterfrom
fix/52617/fix-group-admin-delegation
Jun 3, 2025
Merged

fix(provisioning_api): Allow group details access for users with admin delegation#53275
nfebe merged 1 commit into
masterfrom
fix/52617/fix-group-admin-delegation

Conversation

@nfebe

@nfebenfebe commented Jun 3, 2025

Copy link
Copy Markdown
Contributor

This fixes an issue where users with "Administration privileges → Users" could not access the groups details endpoint in the provisioning API, resulting in a 403 Forbidden error.

There is a problem with adding the AuthorizedAdminSetting attribute (middleware) that only allows access to users with Sharing admin privileges.

Users with "Users admin" privileges should also be able to access group details.

Resolves: #52617

Introduced in : #46815

@nfebe
nfebe requested a review from a team as a code ownerJune 3, 2025 07:16
@nfebe
nfebe requested review from sorbaugh and removed request for a teamJune 3, 2025 07:16
@nfebenfebe added the 3. to review Waiting for reviews label Jun 3, 2025
@github-project-automationgithub-project-automationBot moved this to 🏗️ In progress in 📁 Files teamJun 3, 2025
@nfebe
nfebe requested a review from come-ncJune 3, 2025 07:17
@provokateurin

Copy link
Copy Markdown
Member

Introduced in : #46815

I don't get how the move from annotation to attribute should be responsible for this? Maybe you didn't read the entire commit when checking the git blame.

@nfebe

nfebe commented Jun 3, 2025

Copy link
Copy Markdown
ContributorAuthor

I don't get how the move from annotation to attribute should be responsible for this? Maybe you didn't read the entire commit when checking the git blame.

Right, sorry for git-blaming your commit, the issue then is simply the use of the middleware AuthorizedAdminSetting either in the middleware or annotation form (@AuthorizedAdminSetting(settings=OCA\Settings\Settings\Admin\Sharing))

@provokateurinprovokateurin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think adding #[AuthorizedAdminSetting(settings: Users::class)] should be enough.

…n delegation
This fixes an issue where users with "Administration privileges → Users" could not access
the groups details endpoint in the provisioning API, resulting in a 403 Forbidden error.
There is a problem with adding the `AuthorizedAdminSetting` attribute (middleware)
that only allows access to users with Sharing admin privileges.
Users with "`Users` admin" privileges should also be able to access group details.
Resolves: #52617
Signed-off-by: nfebe <fenn25.fn@gmail.com>
@nfebe
nfebeforce-pushed the fix/52617/fix-group-admin-delegation branch from ca148d6 to b647ca6CompareJune 3, 2025 08:05
@nfebe
nfebe requested a review from provokateurinJune 3, 2025 08:06
@nfebe
nfebe enabled auto-merge June 3, 2025 14:34
@nfebe

nfebe commented Jun 3, 2025

Copy link
Copy Markdown
ContributorAuthor

/backport to stable31

@nfebe
nfebe merged commit 5d62ca6 into masterJun 3, 2025
@nfebe
nfebe deleted the fix/52617/fix-group-admin-delegation branch June 3, 2025 14:41
@skjnldsvskjnldsv mentioned this pull request Aug 19, 2025
@come-nc

Copy link
Copy Markdown
Contributor

/backport to stable30

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to reviewWaiting for reviews

Projects

Status: 🏗️ In progress

Development

Successfully merging this pull request may close these issues.

[Bug]: Regression: Admin-privileged group members cannot see or assign users to existing groups in Nextcloud 31.0.4

4 participants

@nfebe@provokateurin@come-nc@yemkareems