Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(SecurityMiddleware): Allow app_api to bypass user check #45702

Closed
wants to merge 1 commit into from

Conversation

provokateurin
Copy link
Member

Summary

Necessary for #45391. ExApps need to be able to call endpoints without specifying a user.

Checklist

Signed-off-by: provokateurin <kate@provokateurin.de>
Copy link
Member

@nickvergessen nickvergessen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is not the way to go to solve the issue in #45391

@bigcat88
Copy link
Member

bigcat88 commented Jun 7, 2024

PR is good, we just make sure that the new AI APIs that we are developing for NC30 can be called without a specified user in the session, and that they can be used by ExApps that do not have “system” privileges (they cannot impersonate the default user)

This condition does not change any operating logic; they still cannot call admin endpoints.

@nickvergessen nickvergessen deleted the feat/securitymiddleware/bypass-app_api branch June 7, 2024 11:25
@skjnldsv skjnldsv removed this from the Nextcloud 30 milestone Aug 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Waiting for reviews enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants