Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 32

Fix authorization check in reset password (#1182)

Browse source 
Improper authorization checks made it so that users could not reset
their password with a reset token.
This commit is contained in:
Zach Wasserman 2021-06-23 15:59:13 -07:00 committed by GitHub
parent 7af97579fe
commit 675e551484
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
server/service/service_users.go
View file

@ -299,19 +299,20 @@ func (svc *Service) ChangePassword(ctx context.Context, oldPass, newPass string)
}
func (svc *Service) ResetPassword(ctx context.Context, token, password string) error {
// skipauth: No viewer context available. The user is locked out of their
// account and authNZ is performed entirely by providing a valid password
// reset token.
svc.authz.SkipAuthorization(ctx)
reset, err := svc.ds.FindPassswordResetByToken(token)
if err != nil {
return errors.Wrap(err, "looking up reset by token")
}
user, err := svc.User(ctx, reset.UserID)
user, err := svc.ds.UserByID(reset.UserID)
if err != nil {
return errors.Wrap(err, "retrieving user")
}
if err := svc.authz.Authorize(ctx, user, fleet.ActionWrite); err != nil {
return err
}
if user.SSOEnabled {
return errors.New("password reset for single sign on user not allowed")
}