mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

[MM-42421] Prevent guests from seeing users through groups API (#21151)

Просмотр исходного кода
Этот коммит содержится в:
cyrilzhang-mm
2022-10-25 11:54:51 -04:00
коммит произвёл GitHub
родитель c5f4882f0a
Коммит a648ced221
17 изменённых файлов: 406 добавлений и 178 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

53
api4/group.go
Просмотреть файл

@@ -105,9 +105,15 @@ func getGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
restrictions, appErr := c.App.GetViewUsersRestrictions(c.AppContext.Session().UserId)
if appErr != nil {
c.Err = appErr
return
}
group, appErr := c.App.GetGroup(c.Params.GroupId, &model.GetGroupOpts{
IncludeMemberCount: c.Params.IncludeMemberCount,
})
}, restrictions)
if appErr != nil {
c.Err = appErr
return
@@ -206,7 +212,7 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
group, appErr := c.App.GetGroup(c.Params.GroupId, nil)
group, appErr := c.App.GetGroup(c.Params.GroupId, nil, nil)
if appErr != nil {
c.Err = appErr
return
@@ -321,7 +327,7 @@ func linkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
group, appErr := c.App.GetGroup(c.Params.GroupId, nil)
group, appErr := c.App.GetGroup(c.Params.GroupId, nil, nil)
if appErr != nil {
c.Err = appErr
return
@@ -657,7 +663,7 @@ func getGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
group, appErr := c.App.GetGroup(c.Params.GroupId, nil)
group, appErr := c.App.GetGroup(c.Params.GroupId, nil, nil)
if appErr != nil {
c.Err = appErr
return
@@ -675,7 +681,13 @@ func getGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
members, count, appErr := c.App.GetGroupMemberUsersPage(c.Params.GroupId, c.Params.Page, c.Params.PerPage)
restrictions, appErr := c.App.GetViewUsersRestrictions(c.AppContext.Session().UserId)
if appErr != nil {
c.Err = appErr
return
}
members, count, appErr := c.App.GetGroupMemberUsersPage(c.Params.GroupId, c.Params.Page, c.Params.PerPage, restrictions)
if appErr != nil {
c.Err = appErr
return
@@ -718,7 +730,7 @@ func getGroupStats(c *Context, w http.ResponseWriter, r *http.Request) {
}
groupID := c.Params.GroupId
count, appErr := c.App.GetGroupMemberCount(groupID)
count, appErr := c.App.GetGroupMemberCount(groupID, nil)
if appErr != nil {
c.Err = appErr
return
@@ -1011,12 +1023,33 @@ func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {
opts.Since = since
}
groups, appErr := c.App.GetGroups(c.Params.Page, c.Params.PerPage, opts)
restrictions, appErr := c.App.GetViewUsersRestrictions(c.AppContext.Session().UserId)
if appErr != nil {
c.Err = appErr
return
}
var (
groups = []*model.Group{}
canSee bool = true
)
if opts.FilterHasMember != "" {
canSee, appErr = c.App.UserCanSeeOtherUser(c.AppContext.Session().UserId, opts.FilterHasMember)
if appErr != nil {
c.Err = appErr
return
}
}
if canSee {
groups, appErr = c.App.GetGroups(c.Params.Page, c.Params.PerPage, opts, restrictions)
if appErr != nil {
c.Err = appErr
return
}
}
var (
b []byte
err error
@@ -1055,7 +1088,7 @@ func deleteGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
group, err := c.App.GetGroup(c.Params.GroupId, nil)
group, err := c.App.GetGroup(c.Params.GroupId, nil, nil)
if err != nil {
c.Err = err
return
@@ -1103,7 +1136,7 @@ func addGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
group, appErr := c.App.GetGroup(c.Params.GroupId, nil)
group, appErr := c.App.GetGroup(c.Params.GroupId, nil, nil)
if appErr != nil {
c.Err = appErr
return
@@ -1162,7 +1195,7 @@ func deleteGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
group, appErr := c.App.GetGroup(c.Params.GroupId, nil)
group, appErr := c.App.GetGroup(c.Params.GroupId, nil, nil)
if appErr != nil {
c.Err = appErr
return

2
api4/group_test.go
Просмотреть файл

@@ -1518,7 +1518,7 @@ func TestAddMembersToGroup(t *testing.T) {
assert.Len(t, groupMembers, 2)
count, countErr := th.App.GetGroupMemberCount(group.Id)
count, countErr := th.App.GetGroupMemberCount(group.Id, nil)
assert.Nil(t, countErr)
assert.Equal(t, count, int64(2))

6
api4/user.go
Просмотреть файл

@@ -829,7 +829,7 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
profiles, _, appErr = c.App.GetGroupMemberUsersPage(inGroupId, c.Params.Page, c.Params.PerPage)
profiles, _, appErr = c.App.GetGroupMemberUsersPage(inGroupId, c.Params.Page, c.Params.PerPage, userGetOptions.ViewRestrictions)
if appErr != nil {
c.Err = appErr
return
@@ -842,7 +842,7 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
profiles, appErr = c.App.GetUsersNotInGroupPage(notInGroupId, c.Params.Page, c.Params.PerPage)
profiles, appErr = c.App.GetUsersNotInGroupPage(notInGroupId, c.Params.Page, c.Params.PerPage, userGetOptions.ViewRestrictions)
if appErr != nil {
c.Err = appErr
return
@@ -876,7 +876,7 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
}
func requireGroupAccess(c *web.Context, groupID string) *model.AppError {
group, err := c.App.GetGroup(groupID, nil)
group, err := c.App.GetGroup(groupID, nil, nil)
if err != nil {
return err
}

37
api4/user_test.go
Просмотреть файл

@@ -2717,13 +2717,26 @@ func TestGetUsersInGroup(t *testing.T) {
})
assert.Nil(t, appErr)
cid := model.NewId()
customGroup, appErr := th.App.CreateGroup(&model.Group{
DisplayName: "dn-foo_" + cid,
Name: model.NewString("name" + cid),
Source: model.GroupSourceCustom,
Description: "description_" + cid,
RemoteId: model.NewString(model.NewId()),
})
assert.Nil(t, appErr)
user1, err := th.App.CreateUser(th.Context, &model.User{Email: th.GenerateTestEmail(), Nickname: "test user1", Password: "test-password-1", Username: "test-user-1", Roles: model.SystemUserRoleId})
assert.Nil(t, err)
t.Run("Requires ldap license", func(t *testing.T) {
_, response, err := th.SystemAdminClient.GetUsersInGroup(group.Id, 0, 60, "")
require.Error(t, err)
CheckForbiddenStatus(t, response)
})
th.App.Srv().SetLicense(model.NewTestLicense("ldap"))
th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional))
t.Run("Requires manage system permission to access users in group", func(t *testing.T) {
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
@@ -2732,8 +2745,6 @@ func TestGetUsersInGroup(t *testing.T) {
CheckForbiddenStatus(t, response)
})
user1, err := th.App.CreateUser(th.Context, &model.User{Email: th.GenerateTestEmail(), Nickname: "test user1", Password: "test-password-1", Username: "test-user-1", Roles: model.SystemUserRoleId})
assert.Nil(t, err)
_, err = th.App.UpsertGroupMember(group.Id, user1.Id)
assert.Nil(t, err)
@@ -2748,6 +2759,26 @@ func TestGetUsersInGroup(t *testing.T) {
require.NoError(t, err)
assert.Empty(t, users)
})
_, err = th.App.UpsertGroupMember(customGroup.Id, user1.Id)
assert.Nil(t, err)
t.Run("Returns users in custom group when called by regular user", func(t *testing.T) {
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
users, _, err := th.Client.GetUsersInGroup(customGroup.Id, 0, 60, "")
require.NoError(t, err)
assert.Equal(t, users[0].Id, user1.Id)
})
t.Run("Returns no users in custom group when called by guest user", func(t *testing.T) {
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
th.App.DemoteUserToGuest(th.Context, th.BasicUser)
users, _, err := th.Client.GetUsersInGroup(customGroup.Id, 0, 60, "")
require.NoError(t, err)
assert.Equal(t, len(users), 0)
})
}
func TestUpdateUserMfa(t *testing.T) {