{"record":{"id":"7647c1933c5eee88","repo":"passbolt/passbolt_api","slug":"metadata-settings-endpoints-are-disabled","errorCode":null,"errorMessage":"Metadata settings endpoints are disabled.","messagePattern":"Metadata settings endpoints are disabled\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"warning","filePath":"plugins/PassboltCe/Metadata/src/Middleware/MetadataSettingsSecurityMiddleware.php","lineNumber":41,"sourceCode":"use Psr\\Http\\Server\\MiddlewareInterface;\nuse Psr\\Http\\Server\\RequestHandlerInterface;\n\nclass MetadataSettingsSecurityMiddleware implements MiddlewareInterface\n{\n    public const PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED =\n        'passbolt.security.metadata.settings.editionDisabled';\n\n    /**\n     * @param \\Psr\\Http\\Message\\ServerRequestInterface $request The request.\n     * @param \\Psr\\Http\\Server\\RequestHandlerInterface $handler The handler.\n     * @return \\Psr\\Http\\Message\\ResponseInterface The response.\n     */\n    public function process(\n        ServerRequestInterface $request,\n        RequestHandlerInterface $handler\n    ): ResponseInterface {\n        if (Configure::read(self::PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED)) {\n            throw new ForbiddenException(__('Metadata settings endpoints are disabled.'));\n        }\n\n        return $handler->handle($request);\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":47,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Middleware/MetadataSettingsSecurityMiddleware.php#L23-L47","documentation":"The metadata settings security middleware short-circuits all metadata settings endpoints when the config flag PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED is true, throwing a 403 ForbiddenException before the request is handled.","triggerScenarios":"Any request to /metadata/settings endpoints while passbolt.security.metadataSettings.editionDisabled (PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED) is set true in config or environment.","commonSituations":"Pro installations with that security flag enabled; config copied from an environment where the flag was set; setting enabled via environment variable in deployments that later need metadata settings.","solutions":["Remove or set the flag to false: Configure 'passbolt.security.metadataSettings.editionDisabled' => false (or unset PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED env var).","Clear the cache after config changes (passbolt cache clear / restart).","Verify with the right edition: confirm the flag is intended for your deployment before disabling."],"exampleFix":"// before (config/passbolt.php)\n'security' => ['metadataSettings' => ['editionDisabled' => true]],\n// after\n'security' => ['metadataSettings' => ['editionDisabled' => false]],","handlingStrategy":"try-catch","validationCode":"// detect the disabled flag via a cheap settings check or deployment config\nconst disabled = await getServerSetting('passbolt.security.metadataSettings.editionDisabled');\nif (disabled) hideMetadataSettingsUI();","typeGuard":null,"tryCatchPattern":"try { await api.get('/metadata/settings'); } catch (e) { if (e.response?.status === 403 && String(e.message).includes('disabled')) { featureFlag.metadataSettings = false; return; } throw e; }","preventionTips":["Keep security flags consistent across environments in deployment config.","Remove PASSBOLT_SECURITY_METADATA_SETTINGS_EDITION_DISABLED env var if metadata settings are needed.","Detect 403 on settings endpoints and degrade the UI gracefully."],"tags":["forbidden","config","middleware","security-flag"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}