IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2026-08-27 05:37:15 -05:00
Code Issues Packages Projects Releases Wiki Activity

MM-63195: Enforce MFA requirement for non-self requests (#30290)

Browse Source 
https://mattermost.atlassian.net/browse/MM-63195

```release-note
NONE
```
This commit is contained in:
Agniva De Sarker
2025-02-22 12:54:52 +05:30
committed by GitHub
parent 96c2d4ae56
commit fa9af97727
2 changed files with 41 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/channels/api4/user.go
+8 -3
View File
@@ -1650,7 +1650,12 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if user, err := c.App.GetUser(c.Params.UserId); err == nil {
if appErr := c.App.MFARequired(c.AppContext); !c.AppContext.Session().Local && c.AppContext.Session().UserId != c.Params.UserId && appErr != nil {
c.Err = appErr
return
}
if user, appErr := c.App.GetUser(c.Params.UserId); appErr == nil {
audit.AddEventParameterAuditable(auditRec, "user", user)
}
@@ -1672,8 +1677,8 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
c.LogAudit("attempt")
if err := c.App.UpdateMfa(c.AppContext, activate, c.Params.UserId, code); err != nil {
c.Err = err
if appErr := c.App.UpdateMfa(c.AppContext, activate, c.Params.UserId, code); appErr != nil {
c.Err = appErr
return
}
server/channels/api4/user_test.go
+33 -9
View File
@@ -3443,19 +3443,43 @@ func TestUpdateUserMfa(t *testing.T) {
defer th.TearDown()
th.App.Srv().SetLicense(model.NewTestLicense("mfa"))
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableMultifactorAuthentication = true })
t.Run("Without enforcing", func(t *testing.T) {
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableMultifactorAuthentication = true })
session, _ := th.App.GetSession(th.Client.AuthToken)
session.IsOAuth = true
th.App.AddSessionToCache(session)
session, _ := th.App.GetSession(th.Client.AuthToken)
session.IsOAuth = true
th.App.AddSessionToCache(session)
resp, err := th.Client.UpdateUserMfa(context.Background(), th.BasicUser.Id, "12345", false)
require.Error(t, err)
CheckForbiddenStatus(t, resp)
defer th.Server.Platform().ClearUserSessionCacheLocal(th.BasicUser.Id)
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
_, err = client.UpdateUserMfa(context.Background(), th.BasicUser.Id, "12345", false)
resp, err := th.Client.UpdateUserMfa(context.Background(), th.BasicUser.Id, "12345", false)
require.Error(t, err)
CheckForbiddenStatus(t, resp)
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
_, err := client.UpdateUserMfa(context.Background(), th.BasicUser.Id, "12345", false)
require.NoError(t, err)
})
})
t.Run("Enforcing", func(t *testing.T) {
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.EnableMultifactorAuthentication = true
*cfg.ServiceSettings.EnforceMultifactorAuthentication = true
})
resp, err := th.Client.UpdateUserMfa(context.Background(), th.BasicUser.Id, "12345", false)
require.NoError(t, err)
CheckOKStatus(t, resp)
resp, err = th.LocalClient.UpdateUserMfa(context.Background(), th.BasicUser.Id, "12345", false)
require.NoError(t, err)
CheckOKStatus(t, resp)
resp, err = th.SystemAdminClient.UpdateUserMfa(context.Background(), th.BasicUser.Id, "12345", false)
require.Error(t, err)
CheckForbiddenStatus(t, resp)
CheckErrorID(t, err, "api.context.mfa_required.app_error")
})
}