fix: allows admin to edit global credentials

Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
nextcloud · Jun 24, 2024 · ddd3ca0 · ddd3ca0
1 parent 4680bc4
commit ddd3ca0
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/apps/files_external/lib/Controller/AjaxController.php b/apps/files_external/lib/Controller/AjaxController.php
@@ -86,13 +86,16 @@ public function saveGlobalCredentials($uid, $user, $password) {
 		$currentUser = $this->userSession->getUser();
 
 		// Non-admins can only edit their own credentials
-		$allowedToEdit = ($currentUser->getUID() === $uid);
+		// Admin can edit global credentials
+		$allowedToEdit = $uid === ''
+			? $this->groupManager->isAdmin($currentUser->getUID())
+			: $currentUser->getUID() === $uid;
 
 		if ($allowedToEdit) {
 			$this->globalAuth->saveAuth($uid, $user, $password);
 			return true;
-		} else {
-			return false;
 		}
+
+		return false;
 	}
 }