Added LimitedAccessSpace settings

common/ASC.Core.Common/Core/TenantRegistrationInfo.cs

@@ -44,6 +44,7 @@ public class TenantRegistrationInfo
     public bool Spam { get; set; }
     public bool Calls { get; set; }
     public string Campaign { get; set; }
+    public bool LimitedAccessSpace { get; set; }
 
     public TenantRegistrationInfo()
     {

common/ASC.Core.Common/HostedSolution.cs

@@ -32,15 +32,15 @@ namespace ASC.Core;
 [Scope]
 public class HostedSolution
 {
-    internal ITenantService TenantService { get; set; }
+    private readonly ITenantService _tenantService;
-    internal IUserService UserService { get; set; }
+    private readonly IUserService _userService;
-    internal IQuotaService QuotaService { get; set; }
+    private readonly IQuotaService _quotaService;
-    internal ITariffService TariffService { get; set; }
+    private readonly ITariffService _tariffService;
-    internal UserFormatter UserFormatter { get; set; }
+    private readonly UserFormatter _userFormatter;
-    internal TenantManager ClientTenantManager { get; set; }
+    private readonly TenantManager _clientTenantManager;
-    internal TenantUtil TenantUtil { get; set; }
+    private readonly TenantUtil _tenantUtil;
-    internal SettingsManager SettingsManager { get; set; }
+    private readonly SettingsManager _settingsManager;
-    internal CoreSettings CoreSettings { get; set; }
+    private readonly CoreSettings _coreSettings;
 
     public HostedSolution(ITenantService tenantService,
         IUserService userService,
@@ -52,50 +52,50 @@ public class HostedSolution
         SettingsManager settingsManager,
         CoreSettings coreSettings)
     {
-        TenantService = tenantService;
+        _tenantService = tenantService;
-        UserService = userService;
+        _userService = userService;
-        QuotaService = quotaService;
+        _quotaService = quotaService;
-        TariffService = tariffService;
+        _tariffService = tariffService;
-        UserFormatter = userFormatter;
+        _userFormatter = userFormatter;
-        ClientTenantManager = clientTenantManager;
+        _clientTenantManager = clientTenantManager;
-        TenantUtil = tenantUtil;
+        _tenantUtil = tenantUtil;
-        SettingsManager = settingsManager;
+        _settingsManager = settingsManager;
-        CoreSettings = coreSettings;
+        _coreSettings = coreSettings;
     }
 
     public async Task<List<Tenant>> GetTenantsAsync(DateTime from)
     {
-        return (await TenantService.GetTenantsAsync(from)).ToList();
+        return (await _tenantService.GetTenantsAsync(from)).ToList();
     }
 
     public async Task<List<Tenant>> FindTenantsAsync(string login, string passwordHash = null)
     {
-        if (!string.IsNullOrEmpty(passwordHash) && await UserService.GetUserByPasswordHashAsync(Tenant.DefaultTenant, login, passwordHash) == null)
+        if (!string.IsNullOrEmpty(passwordHash) && _userService.GetUserByPasswordHashAsync(Tenant.DefaultTenant, login, passwordHash) == null)
         {
             throw new SecurityException("Invalid login or password.");
         }
 
-        return (await TenantService.GetTenantsAsync(login, passwordHash)).ToList();
+        return (await _tenantService.GetTenantsAsync(login, passwordHash)).ToList();
     }
 
     public async Task<Tenant> GetTenantAsync(string domain)
     {
-        return await TenantService.GetTenantAsync(domain);
+        return await _tenantService.GetTenantAsync(domain);
     }
 
     public async Task<Tenant> GetTenantAsync(int id)
     {
-        return await TenantService.GetTenantAsync(id);
+        return await _tenantService.GetTenantAsync(id);
     }
 
     public Tenant GetTenant(int id)
     {
-        return TenantService.GetTenant(id);
+        return _tenantService.GetTenant(id);
     }
 
     public async Task CheckTenantAddressAsync(string address)
     {
-        await TenantService.ValidateDomainAsync(address);
+        await _tenantService.ValidateDomainAsync(address);
     }
 
     public async Task<Tenant> RegisterTenantAsync(TenantRegistrationInfo registrationInfo)
@@ -118,7 +118,7 @@ public class HostedSolution
         {
             throw new Exception("Account lastname can not be empty");
         }
-        if (!UserFormatter.IsValidUserName(registrationInfo.FirstName, registrationInfo.LastName))
+        if (!_userFormatter.IsValidUserName(registrationInfo.FirstName, registrationInfo.LastName))
         {
             throw new Exception("Incorrect firstname or lastname");
         }
@@ -142,7 +142,7 @@ public class HostedSolution
             Calls = registrationInfo.Calls
         };
 
-        tenant = await TenantService.SaveTenantAsync(CoreSettings, tenant);
+        tenant = await _tenantService.SaveTenantAsync(_coreSettings, tenant);
 
         // create user
         var user = new UserInfo
@@ -152,33 +152,35 @@ public class HostedSolution
             FirstName = registrationInfo.FirstName,
             Email = registrationInfo.Email,
             MobilePhone = registrationInfo.MobilePhone,
-            WorkFromDate = TenantUtil.DateTimeNow(tenant.TimeZone),
+            WorkFromDate = _tenantUtil.DateTimeNow(tenant.TimeZone),
             ActivationStatus = registrationInfo.ActivationStatus
         };
 
-        user = await UserService.SaveUserAsync(tenant.Id, user);
+        user = await _userService.SaveUserAsync(tenant.Id, user);
-        await UserService.SetUserPasswordHashAsync(tenant.Id, user.Id, registrationInfo.PasswordHash);
+        await _userService.SetUserPasswordHashAsync(tenant.Id, user.Id, registrationInfo.PasswordHash);
-        await UserService.SaveUserGroupRefAsync(tenant.Id, new UserGroupRef(user.Id, Constants.GroupAdmin.ID, UserGroupRefType.Contains));
+        await _userService.SaveUserGroupRefAsync(tenant.Id, new UserGroupRef(user.Id, Constants.GroupAdmin.ID, UserGroupRefType.Contains));
 
         // save tenant owner
         tenant.OwnerId = user.Id;
-        tenant = await TenantService.SaveTenantAsync(CoreSettings, tenant);
+
+        await _settingsManager.SaveAsync(new TenantAccessSpaceSettings { LimitedAccessSpace = registrationInfo.LimitedAccessSpace }, tenant.Id);
+
         return tenant;
     }
 
     public async Task<Tenant> SaveTenantAsync(Tenant tenant)
     {
-        return await TenantService.SaveTenantAsync(CoreSettings, tenant);
+        return await _tenantService.SaveTenantAsync(_coreSettings, tenant);
     }
 
     public async Task RemoveTenantAsync(Tenant tenant)
     {
-        await TenantService.RemoveTenantAsync(tenant.Id);
+        await _tenantService.RemoveTenantAsync(tenant.Id);
     }
 
     public async Task<string> CreateAuthenticationCookieAsync(CookieStorage cookieStorage, int tenantId, Guid userId)
     {
-        var u = await UserService.GetUserAsync(tenantId, userId);
+        var u = await _userService.GetUserAsync(tenantId, userId);
 
         return await CreateAuthenticationCookieAsync(cookieStorage, tenantId, u);
     }
@@ -190,49 +192,49 @@ public class HostedSolution
             return null;
         }
 
-        var tenantSettings = await SettingsManager.LoadAsync<TenantCookieSettings>(tenantId, Guid.Empty);
+        var tenantSettings = await _settingsManager.LoadAsync<TenantCookieSettings>(tenantId, Guid.Empty);
         var expires = tenantSettings.IsDefault() ? DateTime.UtcNow.AddYears(1) : DateTime.UtcNow.AddMinutes(tenantSettings.LifeTime);
-        var userSettings = await SettingsManager.LoadAsync<TenantCookieSettings>(tenantId, user.Id);
+        var userSettings = await _settingsManager.LoadAsync<TenantCookieSettings>(tenantId, user.Id);
 
         return cookieStorage.EncryptCookie(tenantId, user.Id, tenantSettings.Index, expires, userSettings.Index, 0);
     }
 
     public async Task<Tariff> GetTariffAsync(int tenant, bool withRequestToPaymentSystem = true)
     {
-        return await TariffService.GetTariffAsync(tenant, withRequestToPaymentSystem);
+        return await _tariffService.GetTariffAsync(tenant, withRequestToPaymentSystem);
     }
 
     public async Task<TenantQuota> GetTenantQuotaAsync(int tenant)
     {
-        return await ClientTenantManager.GetTenantQuotaAsync(tenant);
+        return await _clientTenantManager.GetTenantQuotaAsync(tenant);
     }
 
     public async Task<IEnumerable<TenantQuota>> GetTenantQuotasAsync()
     {
-        return await ClientTenantManager.GetTenantQuotasAsync();
+        return await _clientTenantManager.GetTenantQuotasAsync();
     }
 
     public async Task<TenantQuota> SaveTenantQuotaAsync(TenantQuota quota)
     {
-        return await ClientTenantManager.SaveTenantQuotaAsync(quota);
+        return await _clientTenantManager.SaveTenantQuotaAsync(quota);
     }
 
     public async Task SetTariffAsync(int tenant, bool paid)
     {
-        var quota = (await QuotaService.GetTenantQuotasAsync()).FirstOrDefault(q => paid ? q.NonProfit : q.Trial);
+        var quota = (await _quotaService.GetTenantQuotasAsync()).FirstOrDefault(q => paid ? q.NonProfit : q.Trial);
         if (quota != null)
         {
-            await TariffService.SetTariffAsync(tenant, new Tariff { Quotas = new List<Quota> { new Quota(quota.TenantId, 1) }, DueDate = DateTime.MaxValue, });
+            await _tariffService.SetTariffAsync(tenant, new Tariff { Quotas = new List<Quota> { new Quota(quota.TenantId, 1) }, DueDate = DateTime.MaxValue, });
         }
     }
 
     public async Task SetTariffAsync(int tenant, Tariff tariff)
     {
-        await TariffService.SetTariffAsync(tenant, tariff);
+        await _tariffService.SetTariffAsync(tenant, tariff);
     }
 
     public async Task<IEnumerable<UserInfo>> FindUsersAsync(IEnumerable<Guid> userIds)
     {
-        return await UserService.GetUsersAllTenantsAsync(userIds);
+        return await _userService.GetUsersAllTenantsAsync(userIds);
     }
 }

common/ASC.Core.Common/Tenants/TenantAccessSpaceSettings.cs

@@ -0,0 +1,48 @@
+// (c) Copyright Ascensio System SIA 2010-2022
+//
+// This program is a free software product.
+// You can redistribute it and/or modify it under the terms
+// of the GNU Affero General Public License (AGPL) version 3 as published by the Free Software
+// Foundation. In accordance with Section 7(a) of the GNU AGPL its Section 15 shall be amended
+// to the effect that Ascensio System SIA expressly excludes the warranty of non-infringement of
+// any third-party rights.
+//
+// This program is distributed WITHOUT ANY WARRANTY, without even the implied warranty
+// of MERCHANTABILITY or FITNESS FOR A PARTICULAR  PURPOSE. For details, see
+// the GNU AGPL at: http://www.gnu.org/licenses/agpl-3.0.html
+//
+// You can contact Ascensio System SIA at Lubanas st. 125a-25, Riga, Latvia, EU, LV-1021.
+//
+// The  interactive user interfaces in modified source and object code versions of the Program must
+// display Appropriate Legal Notices, as required under Section 5 of the GNU AGPL version 3.
+//
+// Pursuant to Section 7(b) of the License you must retain the original Product logo when
+// distributing the program. Pursuant to Section 7(e) we decline to grant you any rights under
+// trademark law for use of our trademarks.
+//
+// All the Product's GUI elements, including illustrations and icon sets, as well as technical writing
+// content are licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0
+// International. See the License terms at http://creativecommons.org/licenses/by-sa/4.0/legalcode
+
+namespace ASC.Core.Tenants;
+
+[Scope]
+[Serializable]
+public class TenantAccessSpaceSettings : ISettings<TenantAccessSpaceSettings>
+{
+    public bool LimitedAccessSpace { get; set; }
+
+    [JsonIgnore]
+    public Guid ID
+    {
+        get { return new Guid("{880585C4-52CD-4AE2-8DA4-3B8E2772753B}"); }
+    }
+
+    public TenantAccessSpaceSettings GetDefault()
+    {
+        return new TenantAccessSpaceSettings
+        {
+            LimitedAccessSpace = false
+        };
+    }
+}

common/services/ASC.Data.Backup/Api/BackupController.cs

@@ -32,6 +32,8 @@ namespace ASC.Data.Backup.Controllers;
 public class BackupController : ControllerBase
 {
     private readonly BackupAjaxHandler _backupHandler;
+    private readonly CoreBaseSettings _coreBaseSettings;
+    private readonly TenantExtra _tenantExtra;
     private readonly IEventBus _eventBus;
     private readonly Guid _currentUserId;
     private readonly int _tenantId;
@@ -40,11 +42,15 @@ public class BackupController : ControllerBase
         BackupAjaxHandler backupAjaxHandler,
         TenantManager tenantManager,
         SecurityContext securityContext,
+        CoreBaseSettings coreBaseSettings,
+        TenantExtra tenantExtra,
         IEventBus eventBus)
     {
         _currentUserId = securityContext.CurrentAccount.ID;
         _tenantId = tenantManager.GetCurrentTenant().Id;
         _backupHandler = backupAjaxHandler;
+        _coreBaseSettings = coreBaseSettings;
+        _tenantExtra = tenantExtra;
         _eventBus = eventBus;
     }
     /// <summary>
@@ -55,6 +61,11 @@ public class BackupController : ControllerBase
     [HttpGet("getbackupschedule")]
     public async Task<BackupAjaxHandler.Schedule> GetBackupSchedule()
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         return await _backupHandler.GetScheduleAsync();
     }
 
@@ -69,6 +80,11 @@ public class BackupController : ControllerBase
     [HttpPost("createbackupschedule")]
     public async Task<bool> CreateBackupScheduleAsync(BackupScheduleDto backupSchedule)
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         var storageType = backupSchedule.StorageType == null ? BackupStorageType.Documents : (BackupStorageType)Int32.Parse(backupSchedule.StorageType);
         var storageParams = backupSchedule.StorageParams == null ? new Dictionary<string, string>() : backupSchedule.StorageParams.ToDictionary(r => r.Key.ToString(), r => r.Value.ToString());
         var backupStored = backupSchedule.BackupsStored == null ? 0 : Int32.Parse(backupSchedule.BackupsStored);
@@ -89,6 +105,11 @@ public class BackupController : ControllerBase
     [HttpDelete("deletebackupschedule")]
     public async Task<bool> DeleteBackupSchedule()
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         await _backupHandler.DeleteScheduleAsync();
 
         return true;
@@ -105,6 +126,11 @@ public class BackupController : ControllerBase
     [HttpPost("startbackup")]
     public async Task<BackupProgress> StartBackupAsync(BackupDto backup)
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         var storageType = backup.StorageType == null ? BackupStorageType.Documents : (BackupStorageType)Int32.Parse(backup.StorageType);
         var storageParams = backup.StorageParams == null ? new Dictionary<string, string>() : backup.StorageParams.ToDictionary(r => r.Key.ToString(), r => r.Value.ToString());
 
@@ -127,6 +153,11 @@ public class BackupController : ControllerBase
     [HttpGet("getbackupprogress")]
     public async Task<BackupProgress> GetBackupProgressAsync()
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         return await _backupHandler.GetBackupProgressAsync();
     }
 
@@ -138,6 +169,11 @@ public class BackupController : ControllerBase
     [HttpGet("getbackuphistory")]
     public async Task<List<BackupHistoryRecord>> GetBackupHistory()
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         return await _backupHandler.GetBackupHistory();
     }
 
@@ -148,6 +184,11 @@ public class BackupController : ControllerBase
     [HttpDelete("deletebackup/{id}")]
     public async Task<bool> DeleteBackup(Guid id)
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         await _backupHandler.DeleteBackupAsync(id);
         return true;
     }
@@ -160,6 +201,10 @@ public class BackupController : ControllerBase
     [HttpDelete("deletebackuphistory")]
     public async Task<bool> DeleteBackupHistory()
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
         await _backupHandler.DeleteAllBackupsAsync();
         return true;
     }
@@ -176,6 +221,11 @@ public class BackupController : ControllerBase
     [HttpPost("startrestore")]
     public async Task<BackupProgress> StartBackupRestoreAsync(BackupRestoreDto backupRestore)
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         var storageParams = backupRestore.StorageParams == null ? new Dictionary<string, string>() : backupRestore.StorageParams.ToDictionary(r => r.Key.ToString(), r => r.Value.ToString());
 
         _eventBus.Publish(new BackupRestoreRequestIntegrationEvent(
@@ -201,13 +251,23 @@ public class BackupController : ControllerBase
     [AllowNotPayment]
     public async Task<BackupProgress> GetRestoreProgressAsync()
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         return await _backupHandler.GetRestoreProgressAsync();
     }
 
     ///<visible>false</visible>
     [HttpGet("backuptmp")]
-    public object GetTempPath()
+    public async Task<object> GetTempPath()
     {
+        if (_coreBaseSettings.Standalone)
+        {
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+        }
+
         return _backupHandler.GetTmpFolder();
     }
 }

web/ASC.Web.Api/Api/Settings/SettingsController.cs

@@ -174,6 +174,7 @@ public class SettingsController : BaseSettingsController
             settings.BookTrainingEmail = _setupInfo.BookTrainingEmail;
             settings.DocumentationEmail = _setupInfo.DocumentationEmail;
             settings.SocketUrl = _configuration["web:hub:url"] ?? "";
+            settings.LimitedAccessSpace = (await _settingsManager.LoadAsync<TenantAccessSpaceSettings>()).LimitedAccessSpace;
 
             settings.Firebase = new FirebaseDto
             {

web/ASC.Web.Api/Api/Settings/StorageController.cs

@@ -25,7 +25,6 @@
 // International. See the License terms at http://creativecommons.org/licenses/by-sa/4.0/legalcode
 
 using ASC.Data.Storage.Encryption.IntegrationEvents.Events;
-using ASC.EventBus.Abstractions;
 
 namespace ASC.Web.Api.Controllers.Settings;
 
@@ -48,6 +47,7 @@ public class StorageController : BaseSettingsController, IDisposable
     private readonly BackupAjaxHandler _backupAjaxHandler;
     private readonly ICacheNotify<DeleteSchedule> _cacheDeleteSchedule;
     private readonly EncryptionWorker _encryptionWorker;
+    private readonly TenantExtra _tenantExtra;
     private readonly ILogger _log;
     private readonly IEventBus _eventBus;
     private readonly SecurityContext _securityContext;
@@ -75,7 +75,8 @@ public class StorageController : BaseSettingsController, IDisposable
         BackupAjaxHandler backupAjaxHandler,
         ICacheNotify<DeleteSchedule> cacheDeleteSchedule,
         EncryptionWorker encryptionWorker,
-        IHttpContextAccessor httpContextAccessor) : base(apiContext, memoryCache, webItemManager, httpContextAccessor)
+        IHttpContextAccessor httpContextAccessor,
+        TenantExtra tenantExtra) : base(apiContext, memoryCache, webItemManager, httpContextAccessor)
     {
         _log = option.CreateLogger("ASC.Api");
         _eventBus = eventBus;
@@ -94,6 +95,7 @@ public class StorageController : BaseSettingsController, IDisposable
         _backupAjaxHandler = backupAjaxHandler;
         _cacheDeleteSchedule = cacheDeleteSchedule;
         _encryptionWorker = encryptionWorker;
+        _tenantExtra = tenantExtra;
         _securityContext = securityContext;
     }
 
@@ -102,10 +104,7 @@ public class StorageController : BaseSettingsController, IDisposable
     {
         await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
-        if (!_coreBaseSettings.Standalone)
+        await _tenantExtra.DemandAccessSpacePermissionAsync();
-        {
-            throw new SecurityException(Resource.ErrorAccessDenied);
-        }
 
         var current = await _settingsManager.LoadAsync<StorageSettings>();
         var consumers = _consumerFactory.GetAll<DataStoreConsumer>();
@@ -171,6 +170,8 @@ public class StorageController : BaseSettingsController, IDisposable
 
         await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
+        await _tenantExtra.DemandAccessSpacePermissionAsync();
+
         var storages = await GetAllStoragesAsync();
 
         if (storages.Any(s => s.Current))
@@ -276,13 +277,10 @@ public class StorageController : BaseSettingsController, IDisposable
                 throw new NotSupportedException();
             }
 
-            if (!_coreBaseSettings.Standalone)
-            {
-                throw new SecurityException(Resource.ErrorAccessDenied);
-            }
-
             await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
+
             var settings = await _encryptionSettingsHelper.LoadAsync();
 
             settings.Password = string.Empty; // Don't show password
@@ -324,10 +322,7 @@ public class StorageController : BaseSettingsController, IDisposable
         {
             await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
-            if (!_coreBaseSettings.Standalone)
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
-            {
-                throw new SecurityException(Resource.ErrorAccessDenied);
-            }
 
             var consumer = _consumerFactory.GetByKey(inDto.Module);
             if (!consumer.IsSet)
@@ -361,10 +356,7 @@ public class StorageController : BaseSettingsController, IDisposable
         {
             await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
-            if (!_coreBaseSettings.Standalone)
+            await _tenantExtra.DemandAccessSpacePermissionAsync();
-            {
-                throw new SecurityException(Resource.ErrorAccessDenied);
-            }
 
             var settings = await _settingsManager.LoadAsync<StorageSettings>();
 
@@ -386,10 +378,7 @@ public class StorageController : BaseSettingsController, IDisposable
     {
         await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
-        if (!_coreBaseSettings.Standalone)
+        await _tenantExtra.DemandAccessSpacePermissionAsync();
-        {
-            throw new SecurityException(Resource.ErrorAccessDenied);
-        }
 
         var current = await _settingsManager.LoadAsync<CdnStorageSettings>();
         var consumers = _consumerFactory.GetAll<DataStoreConsumer>().Where(r => r.Cdn != null);
@@ -401,10 +390,7 @@ public class StorageController : BaseSettingsController, IDisposable
     {
         await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
-        if (!_coreBaseSettings.Standalone)
+        await _tenantExtra.DemandAccessSpacePermissionAsync();
-        {
-            throw new SecurityException(Resource.ErrorAccessDenied);
-        }
 
         var consumer = _consumerFactory.GetByKey(inDto.Module);
         if (!consumer.IsSet)
@@ -439,10 +425,7 @@ public class StorageController : BaseSettingsController, IDisposable
     {
         await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
-        if (!_coreBaseSettings.Standalone)
+        await _tenantExtra.DemandAccessSpacePermissionAsync();
-        {
-            throw new SecurityException(Resource.ErrorAccessDenied);
-        }
 
         await _storageSettingsHelper.ClearAsync(await _settingsManager.LoadAsync<CdnStorageSettings>());
     }
@@ -452,6 +435,8 @@ public class StorageController : BaseSettingsController, IDisposable
     {
         await _permissionContext.DemandPermissionsAsync(SecutiryConstants.EditPortalSettings);
 
+        await _tenantExtra.DemandAccessSpacePermissionAsync();
+
         var schedule = await _backupAjaxHandler.GetScheduleAsync();
         var current = new StorageSettings();
 

web/ASC.Web.Api/Api/Settings/WhitelabelController.cs

@@ -39,6 +39,7 @@ public class WhitelabelController : BaseSettingsController
     private readonly CommonLinkUtility _commonLinkUtility;
     private readonly IMapper _mapper;
     private readonly CompanyWhiteLabelSettingsHelper _companyWhiteLabelSettingsHelper;
+    private readonly TenantExtra _tenantExtra;
 
     public WhitelabelController(
         ApiContext apiContext,
@@ -53,7 +54,9 @@ public class WhitelabelController : BaseSettingsController
         IMemoryCache memoryCache,
         IHttpContextAccessor httpContextAccessor,
         IMapper mapper,
-        CompanyWhiteLabelSettingsHelper companyWhiteLabelSettingsHelper) : base(apiContext, memoryCache, webItemManager, httpContextAccessor)
+        CompanyWhiteLabelSettingsHelper companyWhiteLabelSettingsHelper,
+        TenantExtra tenantExtra)
+        : base(apiContext, memoryCache, webItemManager, httpContextAccessor)
     {
         _permissionContext = permissionContext;
         _settingsManager = settingsManager;
@@ -64,6 +67,7 @@ public class WhitelabelController : BaseSettingsController
         _commonLinkUtility = commonLinkUtility;
         _mapper = mapper;
         _companyWhiteLabelSettingsHelper = companyWhiteLabelSettingsHelper;
+        _tenantExtra = tenantExtra;
     }
 
     ///<visible>false</visible>
@@ -410,7 +414,9 @@ public class WhitelabelController : BaseSettingsController
 
     private async Task DemandRebrandingPermissionAsync()
     {
-        if (!_coreBaseSettings.Standalone || _coreBaseSettings.CustomMode)
+        await _tenantExtra.DemandAccessSpacePermissionAsync();
+
+        if (_coreBaseSettings.CustomMode)
         {
             throw new SecurityException(Resource.ErrorAccessDenied);
         }

web/ASC.Web.Api/ApiModels/ResponseDto/SettingsDto.cs

@@ -61,6 +61,7 @@ public class SettingsDto
     public string DocumentationEmail { get; set; }
     public string LegalTerms { get; set; }
     public bool CookieSettingsEnabled { get; set; }
+    public bool LimitedAccessSpace { get; set; }
 
     public PluginsDto Plugins { get; set; }
 

web/ASC.Web.Core/Utility/TenantExtra.cs

@@ -148,4 +148,12 @@ public class TenantExtra
         }
         return _setupInfo.ChunkUploadSize;
     }
+
+    public async Task DemandAccessSpacePermissionAsync()
+    {
+        if (!_coreBaseSettings.Standalone || (await _settingsManager.LoadAsync<TenantAccessSpaceSettings>()).LimitedAccessSpace)
+        {
+            throw new SecurityException(Resource.ErrorAccessDenied);
+        }
+    }
 }