Readonly Settings

core/Api/SettingsAPI.class.php

@@ -14,8 +14,8 @@ namespace Api\Settings {
   use Api\Parameter\StringType;
   use Api\SettingsAPI;
   use Driver\SQL\Column\Column;
-  use Driver\SQL\Condition\Compare;
-  use Driver\SQL\Condition\CondLike;
+  use Driver\SQL\Condition\CondBool;
+  use Driver\SQL\Condition\CondIn;
   use Driver\SQL\Condition\CondNot;
   use Driver\SQL\Condition\CondRegex;
   use Driver\SQL\Strategy\UpdateStrategy;
@@ -89,29 +89,85 @@ namespace Api\Settings {
       }
 
       $paramKey = new StringType('key', 32);
-      $paramValue = new StringType('value', 1024);
+      $paramValue = new StringType('value', 1024, true, NULL);
 
       $sql = $this->user->getSQL();
       $query = $sql->insert("Settings", array("name", "value"));
+      $keys = array();
+      $deleteKeys = array();
 
       foreach($values as $key => $value) {
         if (!$paramKey->parseParam($key)) {
           $key = print_r($key, true);
           return $this->createError("Invalid Type for key in parameter settings: '$key' (Required: " . $paramKey->getTypeName() . ")");
-        } else if(!$paramValue->parseParam($value)) {
+        } else if(!is_null($value) && !$paramValue->parseParam($value)) {
           $value = print_r($value, true);
           return $this->createError("Invalid Type for value in parameter settings: '$value' (Required: " . $paramValue->getTypeName() . ")");
+        } else if(preg_match("/^[a-zA-Z_][a-zA-Z_0-9-]*$/", $paramKey->value) !== 1) {
+          return $this->createError("The property key should only contain alphanumeric characters, underscores and dashes");
         } else {
-          $query->addRow($paramKey->value, $paramValue->value);
+          if (!is_null($paramValue->value)) {
+            $query->addRow($paramKey->value, $paramValue->value);
+          } else {
+            $deleteKeys[] = $paramKey->value;
+          }
+          $keys[] = $paramKey->value;
         }
       }
 
-      $query->onDuplicateKeyStrategy(new UpdateStrategy(
-        array("name"),
-        array("value" => new Column("value")))
-      );
+      if ($this->isExternalCall()) {
+        $column = $this->checkReadonly($keys);
+        if(!$this->success) {
+          return false;
+        } else if($column !== null) {
+          return $this->createError("Column '$column' is readonly.");
+        }
+      }
 
-      $this->success = ($query->execute() !== FALSE);
+      if (!empty($deleteKeys) && !$this->deleteKeys($keys)) {
+        return false;
+      }
+
+      if (count($deleteKeys) !== count($keys)) {
+        $query->onDuplicateKeyStrategy(new UpdateStrategy(
+          array("name"),
+          array("value" => new Column("value")))
+        );
+
+
+        $this->success = ($query->execute() !== FALSE);
+        $this->lastError = $sql->getLastError();
+      }
+
+      return $this->success;
+    }
+
+    private function checkReadonly(array $keys) {
+      $sql = $this->user->getSQL();
+      $res = $sql->select("name")
+        ->from("Settings")
+        ->where(new CondBool("readonly"))
+        ->where(new CondIn("name", $keys))
+        ->limit(1)
+        ->execute();
+
+      $this->success = ($res !== FALSE);
+      $this->lastError = $sql->getLastError();
+
+      if ($this->success && !empty($res)) {
+        return $res[0]["name"];
+      }
+
+      return null;
+    }
+
+    private function deleteKeys(array $keys) {
+      $sql = $this->user->getSQL();
+      $res = $sql->delete("Settings")
+        ->where(new CondIn("name", $keys))
+        ->execute();
+
+      $this->success = ($res !== FALSE);
       $this->lastError = $sql->getLastError();
       return $this->success;
     }

core/Configuration/CreateDatabase.class.php

@@ -145,18 +145,19 @@ class CreateDatabase {
       ->addString("name", 32)
       ->addString("value", 1024, true)
       ->addBool("private", false)
+      ->addBool("readonly", false)
       ->primaryKey("name");
 
-    $settingsQuery = $sql->insert("Settings", array("name", "value", "private"))
+    $settingsQuery = $sql->insert("Settings", array("name", "value", "private", "readonly"))
       // ->addRow("mail_enabled", "0") # this key will be set during installation
-      ->addRow("mail_host", "", false)
-      ->addRow("mail_port", "", false)
-      ->addRow("mail_username", "", false)
-      ->addRow("mail_password", "", true)
-      ->addRow("mail_from", "", false)
-      ->addRow("message_confirm_email", self::MessageConfirmEmail(), false)
-      ->addRow("message_accept_invite", self::MessageAcceptInvite(), false)
-      ->addRow("message_reset_password", self::MessageResetPassword(), false);
+      ->addRow("mail_host", "", false, false)
+      ->addRow("mail_port", "", false, false)
+      ->addRow("mail_username", "", false, false)
+      ->addRow("mail_password", "", true, false)
+      ->addRow("mail_from", "", false, false)
+      ->addRow("message_confirm_email", self::MessageConfirmEmail(), false, false)
+      ->addRow("message_accept_invite", self::MessageAcceptInvite(), false, false)
+      ->addRow("message_reset_password", self::MessageResetPassword(), false, false);
 
     (Settings::loadDefaults())->addRows($settingsQuery);
     $queries[] = $settingsQuery;

core/Configuration/Settings.class.php

@@ -62,11 +62,11 @@ class Settings {
   }
 
   public function addRows(Insert $query) {
-    $query->addRow("site_name", $this->siteName, false)
-      ->addRow("base_url", $this->baseUrl, false)
-      ->addRow("user_registration_enabled", $this->registrationAllowed ? "1" : "0", false)
-      ->addRow("installation_completed", $this->installationComplete ? "1" : "0", true)
-      ->addRow("jwt_secret", $this->jwtSecret, true);
+    $query->addRow("site_name", $this->siteName, false, false)
+      ->addRow("base_url", $this->baseUrl, false, false)
+      ->addRow("user_registration_enabled", $this->registrationAllowed ? "1" : "0", false, false)
+      ->addRow("installation_completed", $this->installationComplete ? "1" : "0", true, true)
+      ->addRow("jwt_secret", $this->jwtSecret, true, true);
   }
 
   public function getSiteName() {