fix: Bypass RBAC and multitenancy checks in CLI context#978
Open
rubenvdlinde wants to merge 4 commits intodevelopmentfrom
Open
fix: Bypass RBAC and multitenancy checks in CLI context#978rubenvdlinde wants to merge 4 commits intodevelopmentfrom
rubenvdlinde wants to merge 4 commits intodevelopmentfrom
Conversation
When running from CLI (occ commands, repair steps, cron jobs), there is no user session or active organisation. The RBAC check in hasRbacPermission() returned false in both cases, blocking app configuration imports via repair steps. Now checks OC::$CLI and allows access when running from the command line, since these are trusted system operations. Fixes #973
Contributor
Quality Report
Summary
PHP Quality
Vue Quality
Security
License Compliance
composer dependencies (147 total)
npm dependencies (586 total)
PHPUnit TestsPHPUnit tests were not enabled for this run. Integration Tests (Newman)Newman integration tests were not enabled for this run. E2E Tests (Playwright)Playwright E2E tests were not enabled for this run. Generated automatically by the Quality workflow.
|
rjzondervan
previously approved these changes
Mar 24, 2026
lib/Db/MultiTenancyTrait.php
Outdated
| $activeOrg = $this->organisationService->getActiveOrganisation(); | ||
| if ($activeOrg === null) { | ||
| // CLI context — no active organisation is expected. Allow access. | ||
| if (\OC::$CLI === true) { |
Member
There was a problem hiding this comment.
Just a small check: Is there no other way of accessing this information? Looking at the trends in deprecation by Nextcloud they seem not too happy about the \OC::$something accessors
Contributor
Author
There was a problem hiding this comment.
Good catch! PHP_SAPI === 'cli' is a pure PHP constant — no Nextcloud dependency at all, future-proof. Let me update the fix.
\OC::$CLI is a legacy Nextcloud accessor that may be deprecated. PHP_SAPI === 'cli' is a pure PHP constant with no framework dependency, making it future-proof.
Contributor
Quality Report
Summary
PHP Quality
Vue Quality
Security
License Compliance
composer dependencies (147 total)
npm dependencies (586 total)
PHPUnit TestsPHPUnit tests were not enabled for this run. Integration Tests (Newman)Newman integration tests were not enabled for this run. E2E Tests (Playwright)Playwright E2E tests were not enabled for this run. Generated automatically by the Quality workflow.
|
rjzondervan
approved these changes
Mar 24, 2026
Contributor
Quality Report
Summary
PHP Quality
Vue Quality
Security
License Compliance
composer dependencies (147 total)
npm dependencies (595 total)
PHPUnit TestsPHPUnit tests were not enabled for this run. Integration Tests (Newman)Newman integration tests were not enabled for this run. E2E Tests (Playwright)Playwright E2E tests were not enabled for this run. Generated automatically by the Quality workflow.
|
Contributor
Quality Report
Summary
PHP Quality
Vue Quality
Security
License Compliance
composer dependencies (147 total)
npm dependencies (595 total)
PHPUnit TestsPHPUnit tests were not enabled for this run. Integration Tests (Newman)Newman integration tests were not enabled for this run. E2E Tests (Playwright)Playwright E2E tests were not enabled for this run. Generated automatically by the Quality workflow.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
occcommands, repair steps, cron jobs)hasRbacPermission()returnedfalsefor both checks\OC::$CLI === trueand allows access for these trusted system operationsFixes #973
Test plan
docker exec nextcloud php occ maintenance:repairwith Pipelinq installed — schemas should load without "Access denied" errorsdocker exec nextcloud php occ app:disable pipelinq && docker exec nextcloud php occ app:enable pipelinq— same result