fix(settings): Fix config handling

Signed-off-by: provokateurin <kate@provokateurin.de>

lib/Controller/FolderController.php

@@ -16,6 +16,7 @@
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\ApiRoute;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\OCS\OCSForbiddenException;
 use OCP\AppFramework\OCS\OCSNotFoundException;
@@ -151,6 +152,7 @@ private function getRootFolderStorageId(): ?int {
 	/**
 	 * @throws OCSNotFoundException
 	 */
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/folders')]
@@ -170,6 +172,7 @@ public function addFolder(string $mountpoint): DataResponse {
 		return new DataResponse($folder);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'DELETE', url: '/folders/{id}')]
@@ -190,6 +193,7 @@ public function removeFolder(int $id): DataResponse {
 		return new DataResponse(['success' => true]);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'PUT', url: '/folders/{id}')]
@@ -198,6 +202,7 @@ public function setMountPoint(int $id, string $mountPoint): DataResponse {
 		return new DataResponse(['success' => true]);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/folders/{id}/groups')]
@@ -212,6 +217,7 @@ public function addGroup(int $id, string $group): DataResponse {
 		return new DataResponse(['success' => true]);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'DELETE', url: '/folders/{id}/groups/{group}', requirements: ['group' => '.+'])]
@@ -226,6 +232,7 @@ public function removeGroup(int $id, string $group): DataResponse {
 		return new DataResponse(['success' => true]);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/folders/{id}/groups/{group}', requirements: ['group' => '.+'])]
@@ -243,6 +250,7 @@ public function setPermissions(int $id, string $group, int $permissions): DataRe
 	/**
 	 * @throws \OCP\DB\Exception
 	 */
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/folders/{id}/manageACL')]
@@ -257,6 +265,7 @@ public function setManageACL(int $id, string $mappingType, string $mappingId, bo
 		return new DataResponse(['success' => true]);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/folders/{id}/quota')]
@@ -271,6 +280,7 @@ public function setQuota(int $id, int $quota): DataResponse {
 		return new DataResponse(['success' => true]);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/folders/{id}/acl')]
@@ -285,6 +295,7 @@ public function setACL(int $id, bool $acl): DataResponse {
 		return new DataResponse(['success' => true]);
 	}
 
+	#[PasswordConfirmationRequired]
 	#[RequireGroupFolderAdmin]
 	#[NoAdminRequired]
 	#[ApiRoute(verb: 'POST', url: '/folders/{id}/mountpoint')]

package.json

@@ -59,6 +59,7 @@
     "@nextcloud/initial-state": "^2.2.0",
     "@nextcloud/l10n": "^3.1.0",
     "@nextcloud/logger": "^3.0.2",
+    "@nextcloud/password-confirmation": "^5.1.1",
     "@nextcloud/router": "^3.0.1",
     "@nextcloud/vue": "^8.19.0",
     "nextcloud-server": "^0.15.10",

src/settings/Api.ts

@@ -4,6 +4,7 @@
  */
 import { generateUrl, generateOcsUrl } from '@nextcloud/router'
 import axios from '@nextcloud/axios'
+import { confirmPassword } from '@nextcloud/password-confirmation'
 // eslint-disable-next-line n/no-unpublished-import
 import type { OCSResponse } from '@nextcloud/typings/lib/ocs'
 
@@ -74,34 +75,48 @@ export class Api {
 
 	// Updates the list of groups that have been granted delegated admin or subadmin rights on groupfolders
 	async updateDelegatedGroups(newGroups: Group[], classname: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(generateUrl('/apps/settings/') + '/settings/authorizedgroups/saveSettings', {
 			newGroups,
 			class: classname,
 		})
 	}
 
 	async createFolder(mountPoint: string): Promise<Folder> {
+		await confirmPassword()
+
 		const response = await axios.post<OCSResponse<Folder>>(this.getUrl('folders'), { mountpoint: mountPoint })
 		return response.data.ocs.data
 	}
 
 	async deleteFolder(id: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.delete(this.getUrl(`folders/${id}`))
 	}
 
 	async addGroup(folderId: number, group: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/groups`), { group })
 	}
 
 	async removeGroup(folderId: number, group: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.delete(this.getUrl(`folders/${folderId}/groups/${group}`))
 	}
 
 	async setPermissions(folderId: number, group: string, permissions: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/groups/${group}`), { permissions })
 	}
 
 	async setManageACL(folderId: number, type: string, id: string, manageACL: boolean): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/manageACL`), {
 			mappingType: type,
 			mappingId: id,
@@ -110,14 +125,20 @@ export class Api {
 	}
 
 	async setQuota(folderId: number, quota: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/quota`), { quota })
 	}
 
 	async setACL(folderId: number, acl: boolean): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/acl`), { acl: acl ? 1 : 0 })
 	}
 
 	async renameFolder(folderId: number, mountpoint: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/mountpoint`), { mountpoint })
 	}