mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

MM-22273 New auditing system (phase 1) (#13967)

Просмотр исходного кода 
* New auditing API outputting to syslog via TLS

* New config section for specifying remote syslog server IP, port, and cert.

* Legacy audit API retained for access history feature
Этот коммит содержится в:
Doug Lauder
2020-03-12 15:50:21 -04:00
коммит произвёл GitHub
родитель bd1e7f2265
Коммит 4ac0619c90
156 изменённых файлов: 16991 добавлений и 49 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

199
api4/user.go
Просмотреть файл

@@ -14,6 +14,7 @@ import (
"time"
"github.com/mattermost/mattermost-server/v5/app"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/mlog"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/store"
@@ -92,6 +93,11 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
tokenId := r.URL.Query().Get("t")
inviteId := r.URL.Query().Get("iid")
auditRec := c.MakeAuditRecord("createUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("invite_id", inviteId)
auditRec.AddMeta("create_username", user.Username)
// No permission check required
var ruser *model.User
@@ -103,6 +109,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = model.NewAppError("CreateUserWithToken", "api.user.create_user.signup_link_invalid.app_error", nil, err.Error(), http.StatusBadRequest)
return
}
auditRec.AddMeta("token_type", token.Type)
if token.Type == app.TOKEN_TYPE_GUEST_INVITATION {
if c.App.License() == nil {
@@ -119,6 +126,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
ruser, err = c.App.CreateUserWithInviteId(user, inviteId)
} else if c.IsSystemAdmin() {
ruser, err = c.App.CreateUserAsAdmin(user)
auditRec.AddMeta("admin", true)
} else {
ruser, err = c.App.CreateUserFromSignup(user)
}
@@ -128,6 +136,9 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("create_user_id", ruser.Id)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(ruser.ToJson()))
}
@@ -412,13 +423,22 @@ func setProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("setProfileImage", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("set_user_id", c.Params.UserId)
if imageArray[0] != nil {
auditRec.AddMeta("filename", imageArray[0].Filename)
}
imageData := imageArray[0]
if err := c.App.SetProfileImage(c.Params.UserId, imageData); err != nil {
c.Err = err
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -438,18 +458,25 @@ func setDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("setDefaultProfileImage", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("set_user_id", c.Params.UserId)
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
c.Err = err
return
}
auditRec.AddMeta("set_username", user.Username)
if err := c.App.SetDefaultProfileImage(user); err != nil {
c.Err = err
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -859,6 +886,10 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", user.Id)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), user.Id) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -893,7 +924,11 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("update_username", ruser.Username)
auditRec.AddMeta("update_email", ruser.Email)
c.LogAudit("")
w.Write([]byte(ruser.ToJson()))
}
@@ -909,6 +944,10 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("patch_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -948,7 +987,12 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
}
c.App.SetAutoResponderStatus(ruser, ouser.NotifyProps)
auditRec.Success()
auditRec.AddMeta("patch_username", ruser.Username)
auditRec.AddMeta("patch_email", ruser.Email)
c.LogAudit("")
w.Write([]byte(ruser.ToJson()))
}
@@ -960,6 +1004,10 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
userId := c.Params.UserId
auditRec := c.MakeAuditRecord("deleteUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("delete_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), userId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -976,12 +1024,14 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("delete_username", user.Username)
if _, err = c.App.UpdateActive(user, false); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -999,6 +1049,11 @@ func updateUserRoles(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
auditRec.AddMeta("new_roles", newRoles)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_ROLES)
return
@@ -1009,7 +1064,9 @@ func updateUserRoles(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit(fmt.Sprintf("user=%s roles=%s", c.Params.UserId, newRoles))
ReturnStatusOK(w)
}
@@ -1027,6 +1084,11 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserActive", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
auditRec.AddMeta("new_active", active)
// true when you're trying to de-activate yourself
isSelfDeactive := !active && c.Params.UserId == c.App.Session().UserId
@@ -1056,7 +1118,9 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
}
auditRec.Success()
c.LogAudit(fmt.Sprintf("user_id=%s active=%v", user.Id, active))
if isSelfDeactive {
c.App.Srv().Go(func() {
if err = c.App.SendDeactivateAccountEmail(user.Email, user.Locale, c.App.GetSiteURL()); err != nil {
@@ -1078,6 +1142,10 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserAuth", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
userAuth := model.UserAuthFromJson(r.Body)
if userAuth == nil {
c.SetInvalidParam("user")
@@ -1090,7 +1158,10 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("auth_service", user.AuthService)
c.LogAudit(fmt.Sprintf("updated user %s auth to service=%v", c.Params.UserId, user.AuthService))
w.Write([]byte(user.ToJson()))
}
@@ -1134,6 +1205,10 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserMfa", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
if c.App.Session().IsOAuth {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
c.Err.DetailedError += ", attempted access by oauth app"
@@ -1168,7 +1243,10 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("activate", activate)
c.LogAudit("success - mfa updated")
ReturnStatusOK(w)
}
@@ -1210,6 +1288,9 @@ func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) {
props := model.MapFromJson(r.Body)
newPassword := props["new_password"]
auditRec := c.MakeAuditRecord("updatePassword", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
c.LogAudit("attempted")
var err *model.AppError
@@ -1233,7 +1314,9 @@ func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("completed")
ReturnStatusOK(w)
}
@@ -1248,6 +1331,9 @@ func resetPassword(c *Context, w http.ResponseWriter, r *http.Request) {
newPassword := props["new_password"]
auditRec := c.MakeAuditRecord("resetPassword", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token", token)
c.LogAudit("attempt - token=" + token)
if err := c.App.ResetPasswordFromToken(token, newPassword); err != nil {
@@ -1256,6 +1342,7 @@ func resetPassword(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success - token=" + token)
ReturnStatusOK(w)
@@ -1271,6 +1358,10 @@ func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("sendPasswordReset", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("email", email)
sent, err := c.App.SendPasswordReset(email, c.App.GetSiteURL())
if err != nil {
if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode {
@@ -1282,9 +1373,9 @@ func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) {
}
if sent {
auditRec.Success()
c.LogAudit("sent=" + email)
}
ReturnStatusOK(w)
}
@@ -1374,14 +1465,20 @@ func login(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
c.LogAuditWithUserId(id, "attempt - login_id="+loginId)
user, err := c.App.AuthenticateUserForLogin(id, loginId, password, mfaToken, ldapOnly)
auditRec := c.MakeAuditRecord("login", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("login_id", loginId)
auditRec.AddMeta("device_id", deviceId)
c.LogAuditWithUserId(id, "attempt - login_id="+loginId)
user, err := c.App.AuthenticateUserForLogin(id, loginId, password, mfaToken, ldapOnly)
if err != nil {
c.LogAuditWithUserId(id, "failure - login_id="+loginId)
c.Err = err
return
}
auditRec.AddMeta(audit.KeyUserID, user.Id)
if user.IsGuest() {
if c.App.License() == nil {
@@ -1421,6 +1518,7 @@ func login(c *Context, w http.ResponseWriter, r *http.Request) {
user.Sanitize(map[string]bool{})
auditRec.Success()
w.Write([]byte(user.ToJson()))
}
@@ -1429,7 +1527,10 @@ func logout(c *Context, w http.ResponseWriter, r *http.Request) {
}
func Logout(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("Logout", audit.Fail)
defer c.LogAuditRec(auditRec)
c.LogAudit("")
c.RemoveSessionCookie(w, r)
if c.App.Session().Id != "" {
if err := c.App.RevokeSessionById(c.App.Session().Id); err != nil {
@@ -1438,6 +1539,7 @@ func Logout(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1471,6 +1573,10 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("revokeSession", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("revoke_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -1488,6 +1594,7 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("device_id", session.DeviceId)
if session.UserId != c.Params.UserId {
c.SetInvalidUrlParam("user_id")
@@ -1499,6 +1606,9 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1508,6 +1618,10 @@ func revokeAllSessionsForUser(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("revokeAllSessionsForUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("revoke_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -1518,6 +1632,9 @@ func revokeAllSessionsForUser(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1527,11 +1644,17 @@ func revokeAllSessionsAllUsers(c *Context, w http.ResponseWriter, r *http.Reques
return
}
auditRec := c.MakeAuditRecord("revokeAllSessionsAllUsers", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.RevokeSessionsFromAllUsers(); err != nil {
c.Err = err
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1544,6 +1667,10 @@ func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("attachDeviceId", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("device_id", deviceId)
// A special case where we logout of all other sessions with the same device id
if err := c.App.RevokeSessionsForDeviceId(c.App.Session().UserId, deviceId, c.App.Session().Id); err != nil {
c.Err = err
@@ -1581,7 +1708,9 @@ func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1614,12 +1743,17 @@ func verifyUserEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("verifyUserEmail", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.VerifyEmailFromToken(token); err != nil {
c.Err = model.NewAppError("verifyUserEmail", "api.user.verify_email.bad_link.app_error", nil, err.Error(), http.StatusBadRequest)
return
}
auditRec.Success()
c.LogAudit("Email Verified")
ReturnStatusOK(w)
}
@@ -1633,12 +1767,18 @@ func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("sendVerificationEmail", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("email", email)
user, err := c.App.GetUserForLogin("", email)
if err != nil {
// Don't want to leak whether the email is valid or not
ReturnStatusOK(w)
return
}
auditRec.AddMeta("send_user_id", user.Id)
auditRec.AddMeta("send_username", user.Username)
if err = c.App.SendEmailVerification(user, user.Email); err != nil {
// Don't want to leak whether the email is valid or not
@@ -1647,6 +1787,7 @@ func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1657,6 +1798,12 @@ func switchAccountType(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("switchAccountType", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("email", switchRequest.Email)
auditRec.AddMeta("new_service", switchRequest.NewService)
auditRec.AddMeta("old_service", switchRequest.CurrentService)
link := ""
var err *model.AppError
@@ -1683,7 +1830,9 @@ func switchAccountType(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(model.MapToJson(map[string]string{"follow_link": link})))
}
@@ -1693,6 +1842,10 @@ func createUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("create_user_id", c.Params.UserId)
if c.App.Session().IsOAuth {
c.SetPermissionError(model.PERMISSION_CREATE_USER_ACCESS_TOKEN)
c.Err.DetailedError += ", attempted access by oauth app"
@@ -1731,7 +1884,10 @@ func createUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("token_id", accessToken.Id)
c.LogAudit("success - token_id=" + accessToken.Id)
w.Write([]byte(accessToken.ToJson()))
}
@@ -1833,6 +1989,9 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetInvalidParam("token_id")
}
auditRec := c.MakeAuditRecord("revokeUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token_id", tokenId)
c.LogAudit("")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_REVOKE_USER_ACCESS_TOKEN) {
@@ -1845,6 +2004,7 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("revoke_user_id", accessToken.UserId)
if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1856,7 +2016,9 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success - token_id=" + accessToken.Id)
ReturnStatusOK(w)
}
@@ -1868,6 +2030,9 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
c.SetInvalidParam("token_id")
}
auditRec := c.MakeAuditRecord("disableUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token_id", tokenId)
c.LogAudit("")
// No separate permission for this action for now
@@ -1881,6 +2046,7 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
c.Err = err
return
}
auditRec.AddMeta("disable_user_id", accessToken.UserId)
if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1892,7 +2058,9 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
c.LogAudit("success - token_id=" + accessToken.Id)
ReturnStatusOK(w)
}
@@ -1904,6 +2072,9 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetInvalidParam("token_id")
}
auditRec := c.MakeAuditRecord("enableUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token_id", tokenId)
c.LogAudit("")
// No separate permission for this action for now
@@ -1917,6 +2088,7 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("enabled_user_id", accessToken.UserId)
if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1928,7 +2100,9 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success - token_id=" + accessToken.Id)
ReturnStatusOK(w)
}
@@ -1939,6 +2113,11 @@ func saveUserTermsOfService(c *Context, w http.ResponseWriter, r *http.Request)
termsOfServiceId := props["termsOfServiceId"].(string)
accepted := props["accepted"].(bool)
auditRec := c.MakeAuditRecord("saveUserTermsOfService", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("terms_id", termsOfServiceId)
auditRec.AddMeta("accepted", accepted)
if _, err := c.App.GetTermsOfService(termsOfServiceId); err != nil {
c.Err = err
return
@@ -1949,7 +2128,9 @@ func saveUserTermsOfService(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
c.LogAudit("TermsOfServiceId=" + termsOfServiceId + ", accepted=" + strconv.FormatBool(accepted))
ReturnStatusOK(w)
}
@@ -1969,6 +2150,10 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("promoteGuestToUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("promote_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_PROMOTE_GUEST) {
c.SetPermissionError(model.PERMISSION_PROMOTE_GUEST)
return
@@ -1979,6 +2164,7 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("promote_username", user.Username)
if !user.IsGuest() {
c.Err = model.NewAppError("Api4.promoteGuestToUser", "api.user.promote_guest_to_user.no_guest.app_error", nil, "", http.StatusNotImplemented)
@@ -1990,6 +2176,7 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -2009,6 +2196,10 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("demoteUserToGuest", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("demote_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_DEMOTE_TO_GUEST) {
c.SetPermissionError(model.PERMISSION_DEMOTE_TO_GUEST)
return
@@ -2019,6 +2210,7 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("demote_username", user.Username)
if user.IsGuest() {
c.Err = model.NewAppError("Api4.demoteUserToGuest", "api.user.demote_user_to_guest.already_guest.app_error", nil, "", http.StatusNotImplemented)
@@ -2030,5 +2222,6 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}