IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

Implement PUT /users/{user_id}/password endpoint for APIv4 (#5243)

Browse Source
This commit is contained in:
Joram Wilander
2017-02-07 09:35:58 -08:00
committed by GitHub
parent ba18374bd1
commit 9dc76c1823
7 changed files with 136 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api4/apitestlib.go
View File

@@ -61,6 +61,8 @@ func Setup() *TestHelper {
}
func TearDown() {
utils.DisableDebugLogForTest()
options := map[string]bool{}
options[store.USER_SEARCH_OPTION_NAMES_ONLY_NO_FULL_NAME] = true
if result := <-app.Srv.Store.User().Search("", "fakeuser", options); result.Err != nil {
@@ -86,6 +88,8 @@ func TearDown() {
}
}
}
utils.EnableDebugLogForTest()
}
func (me *TestHelper) InitBasic() *TestHelper {
@@ -208,7 +212,7 @@ func (me *TestHelper) LoginBasicWithClient(client *model.Client4) {
func (me *TestHelper) LoginBasic2WithClient(client *model.Client4) {
utils.DisableDebugLogForTest()
client.Login(me.BasicUser.Email, me.BasicUser.Password)
client.Login(me.BasicUser2.Email, me.BasicUser2.Password)
utils.EnableDebugLogForTest()
}

38
api4/user.go
View File

@@ -23,6 +23,7 @@ func InitUser() {
BaseRoutes.User.Handle("", ApiSessionRequired(updateUser)).Methods("PUT")
BaseRoutes.User.Handle("", ApiSessionRequired(deleteUser)).Methods("DELETE")
BaseRoutes.User.Handle("/roles", ApiSessionRequired(updateUserRoles)).Methods("PUT")
BaseRoutes.User.Handle("/password", ApiSessionRequired(updatePassword)).Methods("PUT")
BaseRoutes.Users.Handle("/login", ApiHandler(login)).Methods("POST")
BaseRoutes.Users.Handle("/logout", ApiHandler(logout)).Methods("POST")
@@ -281,6 +282,43 @@ func updateUserRoles(c *Context, w http.ResponseWriter, r *http.Request) {
ReturnStatusOK(w)
}
func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) {
c.RequireUserId()
if c.Err != nil {
return
}
props := model.MapFromJson(r.Body)
newPassword := props["new_password"]
c.LogAudit("attempted")
var err *model.AppError
if c.Params.UserId == c.Session.UserId {
currentPassword := props["current_password"]
if len(currentPassword) <= 0 {
c.SetInvalidParam("current_password")
return
}
err = app.UpdatePasswordAsUser(c.Params.UserId, currentPassword, newPassword, c.GetSiteURL())
} else if app.SessionHasPermissionTo(c.Session, model.PERMISSION_MANAGE_SYSTEM) {
err = app.UpdatePasswordByUserIdSendEmail(c.Params.UserId, newPassword, c.T("api.user.reset_password.method"), c.GetSiteURL())
} else {
err = model.NewAppError("updatePassword", "api.user.update_password.context.app_error", nil, "", http.StatusForbidden)
}
if err != nil {
c.LogAudit("failed")
c.Err = err
return
} else {
c.LogAudit("completed")
ReturnStatusOK(w)
}
}
func login(c *Context, w http.ResponseWriter, r *http.Request) {
props := model.MapFromJson(r.Body)

77
api4/user_test.go
View File

@@ -149,7 +149,6 @@ func TestGetUserByEmail(t *testing.T) {
ruser, resp = Client.GetUserByEmail(user.Email, resp.Etag)
CheckEtag(t, ruser, resp)
_, resp = Client.GetUserByEmail(GenerateTestUsername(), "")
CheckBadRequestStatus(t, resp)
@@ -287,7 +286,7 @@ func TestUpdateUser(t *testing.T) {
func TestDeleteUser(t *testing.T) {
th := Setup().InitBasic().InitSystemAdmin()
Client := th.Client
user := th.BasicUser
th.LoginBasic()
@@ -296,7 +295,7 @@ func TestDeleteUser(t *testing.T) {
CheckForbiddenStatus(t, resp)
Client.Logout()
_, resp = Client.DeleteUser(user.Id)
CheckUnauthorizedStatus(t, resp)
@@ -510,3 +509,75 @@ func TestGetUsersNotInChannel(t *testing.T) {
_, resp = th.SystemAdminClient.GetUsersNotInChannel(teamId, channelId, 0, 60, "")
CheckNoError(t, resp)
}
func TestUpdateUserPassword(t *testing.T) {
th := Setup().InitBasic().InitSystemAdmin()
defer TearDown()
Client := th.Client
password := "newpassword1"
pass, resp := Client.UpdateUserPassword(th.BasicUser.Id, th.BasicUser.Password, password)
CheckNoError(t, resp)
if !pass {
t.Fatal("should have returned true")
}
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, password, "")
CheckBadRequestStatus(t, resp)
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, password, "junk")
CheckBadRequestStatus(t, resp)
_, resp = Client.UpdateUserPassword("junk", password, password)
CheckBadRequestStatus(t, resp)
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, "", password)
CheckBadRequestStatus(t, resp)
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, "junk", password)
CheckBadRequestStatus(t, resp)
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, password, th.BasicUser.Password)
CheckNoError(t, resp)
Client.Logout()
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, password, password)
CheckUnauthorizedStatus(t, resp)
th.LoginBasic2()
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, password, password)
CheckForbiddenStatus(t, resp)
th.LoginBasic()
// Test lockout
passwordAttempts := utils.Cfg.ServiceSettings.MaximumLoginAttempts
defer func() {
utils.Cfg.ServiceSettings.MaximumLoginAttempts = passwordAttempts
}()
utils.Cfg.ServiceSettings.MaximumLoginAttempts = 2
// Fail twice
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, "badpwd", "newpwd")
CheckBadRequestStatus(t, resp)
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, "badpwd", "newpwd")
CheckBadRequestStatus(t, resp)
// Should fail because account is locked out
_, resp = Client.UpdateUserPassword(th.BasicUser.Id, th.BasicUser.Password, "newpwd")
CheckErrorMessage(t, resp, "api.user.check_user_login_attempts.too_many.app_error")
CheckForbiddenStatus(t, resp)
// System admin can update another user's password
adminSetPassword := "pwdsetbyadmin"
pass, resp = th.SystemAdminClient.UpdateUserPassword(th.BasicUser.Id, "", adminSetPassword)
CheckNoError(t, resp)
if !pass {
t.Fatal("should have returned true")
}
_, resp = Client.Login(th.BasicUser.Email, adminSetPassword)
CheckNoError(t, resp)
}

8
app/authentication.go
View File

@@ -4,12 +4,12 @@
package app
import (
"net/http"
"strings"
"github.com/mattermost/platform/einterfaces"
"github.com/mattermost/platform/model"
"github.com/mattermost/platform/utils"
"net/http"
"strings"
)
func CheckPasswordAndAllCriteria(user *model.User, password string, mfaToken string) *model.AppError {
@@ -123,7 +123,7 @@ func CheckUserMfa(user *model.User, token string) *model.AppError {
func checkUserLoginAttempts(user *model.User) *model.AppError {
if user.FailedAttempts >= utils.Cfg.ServiceSettings.MaximumLoginAttempts {
return model.NewLocAppError("checkUserLoginAttempts", "api.user.check_user_login_attempts.too_many.app_error", nil, "user_id="+user.Id)
return model.NewAppError("checkUserLoginAttempts", "api.user.check_user_login_attempts.too_many.app_error", nil, "user_id="+user.Id, http.StatusForbidden)
}
return nil

9
app/user.go
View File

@@ -764,22 +764,19 @@ func UpdatePasswordAsUser(userId, currentPassword, newPassword, siteURL string)
}
if user == nil {
err = model.NewLocAppError("updatePassword", "api.user.update_password.valid_account.app_error", nil, "")
err.StatusCode = http.StatusBadRequest
err = model.NewAppError("updatePassword", "api.user.update_password.valid_account.app_error", nil, "", http.StatusBadRequest)
return err
}
if user.AuthData != nil && *user.AuthData != "" {
err = model.NewLocAppError("updatePassword", "api.user.update_password.oauth.app_error", nil, "auth_service="+user.AuthService)
err.StatusCode = http.StatusBadRequest
err = model.NewAppError("updatePassword", "api.user.update_password.oauth.app_error", nil, "auth_service="+user.AuthService, http.StatusBadRequest)
return err
}
if err := doubleCheckPassword(user, currentPassword); err != nil {
if err.Id == "api.user.check_user_password.invalid.app_error" {
err = model.NewLocAppError("updatePassword", "api.user.update_password.incorrect.app_error", nil, "")
err = model.NewAppError("updatePassword", "api.user.update_password.incorrect.app_error", nil, "", http.StatusBadRequest)
}
err.StatusCode = http.StatusForbidden
return err
}

11
model/client4.go
View File

@@ -292,6 +292,17 @@ func (c *Client4) UpdateUser(user *User) (*User, *Response) {
}
}
// UpdateUserPassword updates a user's password. Must be logged in as the user or be a system administrator.
func (c *Client4) UpdateUserPassword(userId, currentPassword, newPassword string) (bool, *Response) {
requestBody := map[string]string{"current_password": currentPassword, "new_password": newPassword}
if r, err := c.DoApiPut(c.GetUserRoute(userId)+"/password", MapToJson(requestBody)); err != nil {
return false, &Response{StatusCode: r.StatusCode, Error: err}
} else {
defer closeBody(r)
return CheckStatusOK(r), BuildResponse(r)
}
}
// UpdateUserRoles updates a user's roles in the system. A user can have "system_user" and "system_admin" roles.
func (c *Client4) UpdateUserRoles(userId, roles string) (bool, *Response) {
requestBody := map[string]string{"roles": roles}

2
utils/config.go
View File

@@ -68,7 +68,7 @@ func FindDir(dir string) string {
func DisableDebugLogForTest() {
if l4g.Global["stdout"] != nil {
originalDisableDebugLvl = l4g.Global["stdout"].Level
l4g.Global["stdout"].Level = l4g.WARNING
l4g.Global["stdout"].Level = l4g.ERROR
}
}