From 8d4465bb29a381cbc35cbcc51e2d004d6e3c7e67 Mon Sep 17 00:00:00 2001
From: Luka Trovic <luka@nextcloud.com>
Date: Tue, 4 Nov 2025 17:09:37 +0100
Subject: [PATCH] fix: check creation permission when import board

Signed-off-by: Luka Trovic <luka@nextcloud.com>
---
 lib/Controller/BoardController.php            |  5 ++++
 lib/Controller/BoardImportApiController.php   |  6 +++++
 tests/integration/base-query-count.txt        |  2 +-
 .../BoardImportApiControllerTest.php          | 23 +++++++++++++++++++
 4 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/lib/Controller/BoardController.php b/lib/Controller/BoardController.php
index 1b7326f80d..eb2b00ac0b 100644
--- a/lib/Controller/BoardController.php
+++ b/lib/Controller/BoardController.php
@@ -9,6 +9,7 @@
 
 use OCA\Deck\Db\Acl;
 use OCA\Deck\Db\Board;
+use OCA\Deck\NoPermissionException;
 use OCA\Deck\Service\BoardService;
 use OCA\Deck\Service\Importer\BoardImportService;
 use OCA\Deck\Service\PermissionService;
@@ -137,6 +138,10 @@ public function export($boardId) {
 	 * @NoAdminRequired
 	 */
 	public function import(): DataResponse {
+		if (!$this->permissionService->canCreate()) {
+			throw new NoPermissionException('Creating boards has been disabled for your account.');
+		}
+
 		$file = $this->request->getUploadedFile('file');
 		$error = null;
 		$phpFileUploadErrors = [
diff --git a/lib/Controller/BoardImportApiController.php b/lib/Controller/BoardImportApiController.php
index c5207b018b..01fdd2a5f2 100644
--- a/lib/Controller/BoardImportApiController.php
+++ b/lib/Controller/BoardImportApiController.php
@@ -7,7 +7,9 @@
 
 namespace OCA\Deck\Controller;
 
+use OCA\Deck\NoPermissionException;
 use OCA\Deck\Service\Importer\BoardImportService;
+use OCA\Deck\Service\PermissionService;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\CORS;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
@@ -21,6 +23,7 @@ public function __construct(
 		string $appName,
 		IRequest $request,
 		private BoardImportService $boardImportService,
+		private PermissionService $permissionService,
 		private string $userId,
 	) {
 		parent::__construct($appName, $request);
@@ -30,6 +33,9 @@ public function __construct(
 	#[CORS]
 	#[NoCSRFRequired]
 	public function import(string $system, array $config, array $data): DataResponse {
+		if (!$this->permissionService->canCreate()) {
+			throw new NoPermissionException('Creating boards has been disabled for your account.');
+		}
 		$this->boardImportService->setSystem($system);
 		$config = json_decode(json_encode($config));
 		$config->owner = $this->userId;
diff --git a/tests/integration/base-query-count.txt b/tests/integration/base-query-count.txt
index a54d62168c..b375f5f94d 100644
--- a/tests/integration/base-query-count.txt
+++ b/tests/integration/base-query-count.txt
@@ -1 +1 @@
-82774
+83517
diff --git a/tests/unit/controller/BoardImportApiControllerTest.php b/tests/unit/controller/BoardImportApiControllerTest.php
index 2ff4a49472..da61d6005c 100644
--- a/tests/unit/controller/BoardImportApiControllerTest.php
+++ b/tests/unit/controller/BoardImportApiControllerTest.php
@@ -25,6 +25,7 @@
 
 use OCA\Deck\Db\Board;
 use OCA\Deck\Service\Importer\BoardImportService;
+use OCA\Deck\Service\PermissionService;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IRequest;
@@ -37,16 +38,20 @@ class BoardImportApiControllerTest extends \Test\TestCase {
 	private $controller;
 	/** @var BoardImportService|MockObject */
 	private $boardImportService;
+	/** @var PermissionService|MockObject */
+	private $permissionService;
 
 	public function setUp(): void {
 		parent::setUp();
 		$this->request = $this->createMock(IRequest::class);
 		$this->boardImportService = $this->createMock(BoardImportService::class);
+		$this->permissionService = $this->createMock(PermissionService::class);
 
 		$this->controller = new BoardImportApiController(
 			$this->appName,
 			$this->request,
 			$this->boardImportService,
+			$this->permissionService,
 			$this->userId
 		);
 	}
@@ -75,9 +80,27 @@ public function testImport() {
 		$data = [
 			'name' => 'test'
 		];
+		$this->permissionService
+			->method('canCreate')
+			->willReturn(true);
 		$actual = $this->controller->import($system, $config, $data);
 		$board = $this->createMock(Board::class);
 		$this->assertInstanceOf(Board::class, $board);
 		$this->assertEquals(HTTP::STATUS_OK, $actual->getStatus());
 	}
+
+	public function testImportWithoutPermission() {
+		$system = 'trelloJson';
+		$config = [
+			'owner' => 'test'
+		];
+		$data = [
+			'name' => 'test'
+		];
+		$this->permissionService
+			->method('canCreate')
+			->willReturn(false);
+		$this->expectException(\OCA\Deck\NoPermissionException::class);
+		$this->controller->import($system, $config, $data);
+	}
 }