Hide updater button when web updater is disabled

Whenever the web updater is disabled, the updater button and its
matching token requesting endpoints are disabled.

Signed-off-by: Vincent Petry <vincent@nextcloud.com>

2 files changed, 10 insertions, 0 deletions

diff --git a/apps/updatenotification/lib/Controller/AdminController.php b/apps/updatenotification/lib/Controller/AdminController.php
index 907d75aed6a..502f0fa5eb5 100644
--- a/apps/updatenotification/lib/Controller/AdminController.php
+++ b/apps/updatenotification/lib/Controller/AdminController.php
@@ -29,6 +29,7 @@ namespace OCA\UpdateNotification\Controller;
 
 use OCA\UpdateNotification\ResetTokenBackgroundJob;
 use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\BackgroundJob\IJobList;
@@ -74,6 +75,10 @@ class AdminController extends Controller {
 		$this->l10n = $l10n;
 	}
 
+	private function isUpdaterEnabled() {
+		return !$this->config->getSystemValue('upgrade.disable-web', false);
+	}
+
 	/**
 	 * @param string $channel
 	 * @return DataResponse
@@ -88,6 +93,10 @@ class AdminController extends Controller {
 	 * @return DataResponse
 	 */
 	public function createCredentials(): DataResponse {
+		if (!$this->isUpdaterEnabled()) {
+			return new DataResponse(['status' => 'error', 'message' => $this->l10n->t('Web updater is disabled')], Http::STATUS_FORBIDDEN);
+		}
+
 		// Create a new job and store the creation date
 		$this->jobList->add(ResetTokenBackgroundJob::class);
 		$this->config->setAppValue('core', 'updater.secret.created', $this->timeFactory->getTime());
diff --git a/apps/updatenotification/lib/Settings/Admin.php b/apps/updatenotification/lib/Settings/Admin.php
index 915f805e605..737484fcb6b 100644
--- a/apps/updatenotification/lib/Settings/Admin.php
+++ b/apps/updatenotification/lib/Settings/Admin.php
@@ -110,6 +110,7 @@ class Admin implements ISettings {
 			'newVersionString' => empty($updateState['updateVersionString']) ? '' : $updateState['updateVersionString'],
 			'downloadLink' => empty($updateState['downloadLink']) ? '' : $updateState['downloadLink'],
 			'changes' => $this->filterChanges($updateState['changes'] ?? []),
+			'webUpdaterEnabled' => !$this->config->getSystemValue('upgrade.disable-web', false),
 			'updaterEnabled' => empty($updateState['updaterEnabled']) ? false : $updateState['updaterEnabled'],
 			'versionIsEol' => empty($updateState['versionIsEol']) ? false : $updateState['versionIsEol'],
 			'isDefaultUpdateServerURL' => $isDefaultUpdateServerURL,