fix: allows admin to edit global credentials

Signed-off-by: Benjamin Gaussorgues <[email protected]>
nextcloud · Jul 27, 2024 · 2355600 · 2355600
1 parent 6cdfe62
commit 2355600
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/apps/files_external/lib/Controller/AjaxController.php b/apps/files_external/lib/Controller/AjaxController.php
@@ -106,15 +106,21 @@ public function getSshKeys($keyLength = 1024) {
 	 */
 	public function saveGlobalCredentials($uid, $user, $password) {
 		$currentUser = $this->userSession->getUser();
+		if ($currentUser === null) {
+			return false;
+		}
 
 		// Non-admins can only edit their own credentials
-		$allowedToEdit = ($currentUser->getUID() === $uid);
+		// Admin can edit global credentials
+		$allowedToEdit = $uid === ''
+			? $this->groupManager->isAdmin($currentUser->getUID())
+			: $currentUser->getUID() === $uid;
 
 		if ($allowedToEdit) {
 			$this->globalAuth->saveAuth($uid, $user, $password);
 			return true;
-		} else {
-			return false;
 		}
+
+		return false;
 	}
 }