[stable28] fix: add PasswordConfirmationRequired to create user storages endpoint

apps/files_external/js/settings.js

@@ -271,14 +271,25 @@ StorageConfig.prototype = {
  * @param {Function} [options.error] error callback
  */
  save: function(options) {
- var self = this;
  var url = OC.generateUrl(this._url);
  var method = 'POST';
  if (_.isNumber(this.id)) {
  method = 'PUT';
  url = OC.generateUrl(this._url + '/{id}', {id: this.id});
  }
 
+ window.OC.PasswordConfirmation.requirePasswordConfirmation(() => this._save(method, url, options), options.error);
+ },
+
+ /**
+ * Private implementation of the save function (called after potential password confirmation)
+ * @param {string} method 
+ * @param {string} url 
+ * @param {{success: Function, error: Function}} options 
+ */
+ _save: function(method, url, options) {
+ self = this;
+
  $.ajax({
  type: method,
  url: url,
@@ -352,6 +363,15 @@ StorageConfig.prototype = {
  }
  return;
  }
+
+ window.OC.PasswordConfirmation.requirePasswordConfirmation(() => this._destroy(options), options.error)
+ },
+
+ /**
+ * Private implementation of the DELETE method called after password confirmation
+ * @param {{ success: Function, error: Function }} options 
+ */
+ _destroy: function(options) {
  $.ajax({
  type: 'DELETE',
  url: OC.generateUrl(this._url + '/{id}', {id: this.id}),

apps/files_external/lib/Controller/UserStoragesController.php

@@ -34,6 +34,8 @@
 use OCA\Files_External\NotFoundException;
 use OCA\Files_External\Service\UserStoragesService;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IConfig;
 use OCP\IGroupManager;
@@ -120,9 +122,9 @@ public function show($id, $testOnly = true) {
  * @param array $mountOptions backend-specific mount options
  *
  * @return DataResponse
- *
- * @NoAdminRequired
  */
+ #[NoAdminRequired]
+ #[PasswordConfirmationRequired]
  public function create(
  $mountPoint,
  $backend,
@@ -176,9 +178,9 @@ public function create(
  * @param bool $testOnly whether to storage should only test the connection or do more things
  *
  * @return DataResponse
- *
- * @NoAdminRequired
  */
+ #[NoAdminRequired]
+ #[PasswordConfirmationRequired]
  public function update(
  $id,
  $mountPoint,
@@ -227,10 +229,10 @@ public function update(
  /**
  * Delete storage
  *
- * @NoAdminRequired
- *
  * {@inheritdoc}
  */
+ #[NoAdminRequired]
+ #[PasswordConfirmationRequired]
  public function destroy($id) {
  return parent::destroy($id);
  }