From 1aae3444c072ab500002bcc703396afa5febaa72 Mon Sep 17 00:00:00 2001 From: Agniva De Sarker Date: Fri, 22 Jan 2021 09:58:08 +0530 Subject: [PATCH] MM-32013: Do not allow password change in /auth endpoint (#16770) We were allowing new password to be reset without asking for the old password. This was not advertised but was possible nevertheless through the API. Since there is already a separate API to change password, we choose to remove this functionality. https://mattermost.atlassian.net/browse/MM-32013 ```release-note The /api/v4/users/me/auth API endpoint cannot be used to change password anymore. This was a hidden feature that was not documented, but was nevertheless possible. We are just removing the hidden feature. ``` Co-authored-by: Mattermod --- api4/user.go | 5 +++++ app/user.go | 31 ++++++++----------------------- i18n/en.json | 8 ++++---- model/user.go | 2 +- 4 files changed, 18 insertions(+), 28 deletions(-) diff --git a/api4/user.go b/api4/user.go index 042856a70f..23ae2f2198 100644 --- a/api4/user.go +++ b/api4/user.go @@ -1398,6 +1398,11 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) { return } + if userAuth.AuthData == nil || *userAuth.AuthData == "" || userAuth.AuthService == "" { + c.Err = model.NewAppError("updateUserAuth", "api.user.update_user_auth.invalid_request", nil, "", http.StatusBadRequest) + return + } + if user, err := c.App.GetUser(c.Params.UserId); err == nil { auditRec.AddMeta("user", user) } diff --git a/app/user.go b/app/user.go index de6383b3cd..5553d025e2 100644 --- a/app/user.go +++ b/app/user.go @@ -1198,29 +1198,14 @@ func (a *App) PatchUser(userId string, patch *model.UserPatch, asAdmin bool) (*m } func (a *App) UpdateUserAuth(userId string, userAuth *model.UserAuth) (*model.UserAuth, *model.AppError) { - if userAuth.AuthData == nil || *userAuth.AuthData == "" || userAuth.AuthService == "" { - userAuth.AuthData = nil - userAuth.AuthService = "" - - if err := a.IsPasswordValid(userAuth.Password); err != nil { - return nil, err - } - password := model.HashPassword(userAuth.Password) - - if err := a.Srv().Store.User().UpdatePassword(userId, password); err != nil { - return nil, model.NewAppError("UpdateUserAuth", "app.user.update_password.app_error", nil, err.Error(), http.StatusInternalServerError) - } - } else { - userAuth.Password = "" - - if _, err := a.Srv().Store.User().UpdateAuthData(userId, userAuth.AuthService, userAuth.AuthData, "", false); err != nil { - var invErr *store.ErrInvalidInput - switch { - case errors.As(err, &invErr): - return nil, model.NewAppError("UpdateUserAuth", "app.user.update_auth_data.email_exists.app_error", nil, invErr.Error(), http.StatusBadRequest) - default: - return nil, model.NewAppError("UpdateUserAuth", "app.user.update_auth_data.app_error", nil, err.Error(), http.StatusInternalServerError) - } + userAuth.Password = "" + if _, err := a.Srv().Store.User().UpdateAuthData(userId, userAuth.AuthService, userAuth.AuthData, "", false); err != nil { + var invErr *store.ErrInvalidInput + switch { + case errors.As(err, &invErr): + return nil, model.NewAppError("UpdateUserAuth", "app.user.update_auth_data.email_exists.app_error", nil, invErr.Error(), http.StatusBadRequest) + default: + return nil, model.NewAppError("UpdateUserAuth", "app.user.update_auth_data.app_error", nil, err.Error(), http.StatusInternalServerError) } } diff --git a/i18n/en.json b/i18n/en.json index 1538f7aed6..13f35f3d5b 100644 --- a/i18n/en.json +++ b/i18n/en.json @@ -3486,6 +3486,10 @@ "id": "api.user.update_user.accepted_guest_domain.app_error", "translation": "The email you provided does not belong to an accepted domain for guest accounts. Please contact your administrator or sign up with a different email." }, + { + "id": "api.user.update_user_auth.invalid_request", + "translation": "Request is missing either AuthData or AuthService parameter." + }, { "id": "api.user.update_user_roles.license.app_error", "translation": "Custom Permission Schemes not supported by current license" @@ -5690,10 +5694,6 @@ "id": "app.user.update_failed_pwd_attempts.app_error", "translation": "Unable to update the failed_attempts." }, - { - "id": "app.user.update_password.app_error", - "translation": "Unable to update the user password." - }, { "id": "app.user.update_thread_follow_for_user.app_error", "translation": "Unable to update following state for thread" diff --git a/model/user.go b/model/user.go index 4dbd002e83..8fc7dc4694 100644 --- a/model/user.go +++ b/model/user.go @@ -126,7 +126,7 @@ type UserPatch struct { } type UserAuth struct { - Password string `json:"password,omitempty"` + Password string `json:"password,omitempty"` // DEPRECATED: It is not used. AuthData *string `json:"auth_data,omitempty"` AuthService string `json:"auth_service,omitempty"` }