fix(settings): Fix config handling

Signed-off-by: provokateurin <kate@provokateurin.de>

lib/Controller/FolderController.php

@@ -113,6 +113,7 @@ private function getRootFolderStorageId(): ?int {
 	/**
 	 * @RequireGroupFolderAdmin
 	 * @NoAdminRequired
+	 * @PasswordConfirmationRequired
 	 */
 	public function addFolder(string $mountpoint): DataResponse {
 		$id = $this->manager->createFolder($mountpoint);
@@ -122,6 +123,7 @@ public function addFolder(string $mountpoint): DataResponse {
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function removeFolder(int $id): DataResponse {
 		$response = $this->checkFolderExists($id);
@@ -137,6 +139,7 @@ public function removeFolder(int $id): DataResponse {
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function setMountPoint(int $id, string $mountPoint): DataResponse {
 		$this->manager->setMountPoint($id, $mountPoint);
@@ -146,6 +149,7 @@ public function setMountPoint(int $id, string $mountPoint): DataResponse {
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function addGroup(int $id, string $group): DataResponse {
 	$response = $this->checkFolderExists($id);
@@ -159,6 +163,7 @@ public function addGroup(int $id, string $group): DataResponse {
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function removeGroup(int $id, string $group): DataResponse {
 	$response = $this->checkFolderExists($id);
@@ -172,6 +177,7 @@ public function removeGroup(int $id, string $group): DataResponse {
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function setPermissions(int $id, string $group, int $permissions): DataResponse {
 	$response = $this->checkFolderExists($id);
@@ -185,6 +191,7 @@ public function setPermissions(int $id, string $group, int $permissions): DataRe
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 * @throws \OCP\DB\Exception
 	 */
 	public function setManageACL(int $id, string $mappingType, string $mappingId, bool $manageAcl): DataResponse {
@@ -199,6 +206,7 @@ public function setManageACL(int $id, string $mappingType, string $mappingId, bo
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function setQuota(int $id, int $quota): DataResponse {
 	$response = $this->checkFolderExists($id);
@@ -212,6 +220,7 @@ public function setQuota(int $id, int $quota): DataResponse {
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function setACL(int $id, bool $acl): DataResponse {
 	$response = $this->checkFolderExists($id);
@@ -225,6 +234,7 @@ public function setACL(int $id, bool $acl): DataResponse {
 	/**
 	 * @NoAdminRequired
 	 * @RequireGroupFolderAdmin
+	 * @PasswordConfirmationRequired
 	 */
 	public function renameFolder(int $id, string $mountpoint): DataResponse {
 	$response = $this->checkFolderExists($id);

package.json

@@ -35,6 +35,7 @@
   "dependencies": {
     "@nextcloud/axios": "^2.0.0",
     "@nextcloud/event-bus": "^3.0.2",
+    "@nextcloud/password-confirmation": "4.0.4",
     "@nextcloud/router": "^2.0.0",
     "@nextcloud/typings": "^1.9.1",
     "@nextcloud/vue": "^7.3.0",

src/settings/Api.ts

@@ -1,5 +1,6 @@
 import axios from '@nextcloud/axios'
 import { generateUrl } from "@nextcloud/router";
+import { confirmPassword } from '@nextcloud/password-confirmation'
 // eslint-disable-next-line n/no-unpublished-import
 import type { OCSResponse } from '@nextcloud/typings/lib/ocs'
 
@@ -59,34 +60,48 @@ export class Api {
 
 	// Updates the list of groups that have been granted delegated admin or subadmin rights on groupfolders
 	async updateDelegatedGroups(newGroups: Group[], classname: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(generateUrl('/apps/settings/') + '/settings/authorizedgroups/saveSettings', {
 			newGroups,
 			class: classname,
 		})
 	}
 
 	async createFolder(mountPoint: string): Promise<number> {
+		await confirmPassword()
+
 		const response = await axios.post<OCSResponse<number>>(this.getUrl('folders'), { mountpoint: mountPoint })
 		return response.data.ocs.data
 	}
 
 	async deleteFolder(id: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.delete(this.getUrl(`folders/${id}`))
 	}
 
 	async addGroup(folderId: number, group: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/groups`), { group })
 	}
 
 	async removeGroup(folderId: number, group: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.delete(this.getUrl(`folders/${folderId}/groups/${group}`))
 	}
 
 	async setPermissions(folderId: number, group: string, permissions: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/groups/${group}`), { permissions })
 	}
 
 	async setManageACL(folderId: number, type: string, id: string, manageACL: boolean): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/manageACL`), {
 			mappingType: type,
 			mappingId: id,
@@ -95,14 +110,20 @@ export class Api {
 	}
 
 	async setQuota(folderId: number, quota: number): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/quota`), { quota })
 	}
 
 	async setACL(folderId: number, acl: boolean): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/acl`), { acl: acl ? 1 : 0 })
 	}
 
 	async renameFolder(folderId: number, mountpoint: string): Promise<void> {
+		await confirmPassword()
+
 		await axios.post(this.getUrl(`folders/${folderId}/mountpoint`), { mountpoint })
 	}