IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

don't clear AuthService/AuthData if user is System Admin (#12986)

Browse Source
This commit is contained in:
Scott Bishel
2019-11-07 12:12:37 -07:00
committed by GitHub
parent 540cfb0239
commit e07e114def
3 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api4/user.go
View File

@@ -86,7 +86,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
user.SanitizeInput()
user.SanitizeInput(c.IsSystemAdmin())
tokenId := r.URL.Query().Get("t")
inviteId := r.URL.Query().Get("iid")

11
api4/user_test.go
View File

@@ -110,10 +110,15 @@ func TestCreateUserInputFilter(t *testing.T) {
_, resp := th.SystemAdminClient.CreateUser(user)
CheckBadRequestStatus(t, resp)
})
t.Run("AuthServiceFilter", func(t *testing.T) {
user := &model.User{Email: "foobar+testdomainrestriction@mattermost.org", Password: "Password1", Username: GenerateTestUsername(), AuthService: "ldap"}
t.Run("ValidAuthServiceFilter", func(t *testing.T) {
user := &model.User{Email: "foobar+testdomainrestriction@mattermost.org", Username: GenerateTestUsername(), AuthService: "ldap", AuthData: model.NewString("999099")}
_, resp := th.SystemAdminClient.CreateUser(user)
CheckNoError(t, resp)
})
t.Run("InvalidAuthServiceFilter", func(t *testing.T) {
user := &model.User{Email: "foobar+testdomainrestriction@mattermost.org", Password: "Password1", Username: GenerateTestUsername(), AuthService: "ldap"}
_, resp := th.Client.CreateUser(user)
CheckBadRequestStatus(t, resp)
})
})

8
model/user.go
View File

@@ -497,9 +497,11 @@ func (u *User) Sanitize(options map[string]bool) {
}
// Remove any input data from the user object that is not user controlled
func (u *User) SanitizeInput() {
u.AuthData = NewString("")
u.AuthService = ""
func (u *User) SanitizeInput(isAdmin bool) {
if !isAdmin {
u.AuthData = NewString("")
u.AuthService = ""
}
u.LastPasswordUpdate = 0
u.LastPictureUpdate = 0
u.FailedAttempts = 0