v0.3

src/admin/api_token_access.rs

@@ -26,7 +26,11 @@ fn general_api_token_allowed(method: &Method, path: &str, permission: &str) -> b
         && ((method == Method::PUT
             && (path == "/api/config"
                 || path.strip_prefix("/api/config/").is_some_and(|part| {
-                    !part.is_empty() && part != "history" && part != "reload" && !part.contains('/')
+                    !part.is_empty()
+                        && part != "history"
+                        && part != "reload"
+                        && part != "storage"
+                        && !part.contains('/')
                 })))
             || (method == Method::POST
                 && matches!(