From e09666252074223885d215119d45a6ab92f807b9 Mon Sep 17 00:00:00 2001 From: Marcel Klehr Date: Mon, 6 Jul 2026 15:18:35 +0200 Subject: [PATCH 1/2] fix(DeclarativeManager): Fix admin delegation Assisted-by: ClaudeCode:claude-opus-4-8 Signed-off-by: Marcel Klehr --- lib/private/Settings/DeclarativeManager.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/private/Settings/DeclarativeManager.php b/lib/private/Settings/DeclarativeManager.php index 534b4b199842e..cc9f479597636 100644 --- a/lib/private/Settings/DeclarativeManager.php +++ b/lib/private/Settings/DeclarativeManager.php @@ -142,8 +142,10 @@ public function getFormsWithValues(IUser $user, ?string $type, ?string $section) if ($section !== null && $schema['section_id'] !== $section) { continue; } - // If listing all fields skip the admin fields which a non-admin user has no access to - if ($type === null && $schema['section_type'] === 'admin' && !$isAdmin) { + // Skip admin declarative forms for non-admin users. They have no access to + // these fields even when they are allowed to view the section through admin + // delegation, which only covers non-declarative settings. + if ($schema['section_type'] === DeclarativeSettingsTypes::SECTION_TYPE_ADMIN && !$isAdmin) { continue; } From a1096f98a510471df1350a60d5dff342f3e1a865 Mon Sep 17 00:00:00 2001 From: Marcel Klehr Date: Tue, 7 Jul 2026 08:55:18 +0200 Subject: [PATCH 2/2] fix(DeclarativeManagerTest): Fix testAdminFormUserUnauthorized Assisted-by: ClaudeCode:claude-opus-4-8 Signed-off-by: Marcel Klehr --- tests/lib/Settings/DeclarativeManagerTest.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tests/lib/Settings/DeclarativeManagerTest.php b/tests/lib/Settings/DeclarativeManagerTest.php index 59411e1f825ae..d3ff46818b72a 100644 --- a/tests/lib/Settings/DeclarativeManagerTest.php +++ b/tests/lib/Settings/DeclarativeManagerTest.php @@ -555,8 +555,15 @@ public function testAdminFormUserUnauthorized(): void { $schema = self::validSchemaAllFields; $this->declarativeManager->registerSchema($app, $schema); + // A non-admin user must not receive admin declarative forms, but this must not + // throw: it would abort rendering of a section a user can legitimately access + // through admin delegation (which only covers non-declarative settings). + $forms = $this->declarativeManager->getFormsWithValues($this->user, $schema['section_type'], $schema['section_id']); + $this->assertEmpty($forms); + + // Writing to an admin declarative form is still forbidden for a non-admin user. $this->expectException(\Exception::class); - $this->declarativeManager->getFormsWithValues($this->user, $schema['section_type'], $schema['section_id']); + $this->declarativeManager->setValue($this->user, $app, $schema['id'], 'some_real_setting', '120m'); } /**