Repository navigation
fix(security): honor every #[AuthorizedAdminSetting] attribute - #66619
Open
mprashantpandey wants to merge 1 commit into
Open
mprashantpandey wants to merge 1 commit into
mprashantpandey wants to merge 1 commit into
Conversation
getAuthorizedAdminSettingClasses() only read the first repeatable attribute, so a user delegated a later setting received 403. Assisted-by: GrokBot:Grok-Bot Signed-off-by: Prashant Pandey <mprashantpandey@users.noreply.github.com>
mprashantpandey
requested review from
icewind1991 and
provokateurin
and removed request for
a team
November 14, 2026 13:35
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since Nextcloud 35,
SecurityMiddleware::getAuthorizedAdminSettingClasses()only reads the first#[AuthorizedAdminSetting]attribute on a controller method. A user who is delegated a later setting gets 403. The attribute is stillIS_REPEATABLE, and the developer manual still tells apps to repeat it.This restores the Nextcloud 34 behaviour: every repeated attribute is collected, and any one of those settings authorises the user. The deprecated
@AuthorizedAdminSetting(settings=A;B)docblock form is unchanged.The method now uses a
ControllerMethodReflector::getAttributes()helper that returns every attribute of a class, not only the first.getAttribute()still returns the first one.This should be backported to
stable35.TODO
#[AuthorizedAdminSetting]attributeChecklist
3. to review, feature component)stable32)AI (if applicable)
Grok Bot in Cursor helped implement the
getAttributes()loop and the unit tests. I reviewed the change. The official PHPUnit file was not run in a full Nextcloud checkout; a standalone PHP script covering the repeated-attribute collection passed.