From e07e114deffda800188249779037b4d8a6ccc87a Mon Sep 17 00:00:00 2001 From: Scott Bishel Date: Thu, 7 Nov 2019 12:12:37 -0700 Subject: [PATCH] don't clear AuthService/AuthData if user is System Admin (#12986) --- api4/user.go | 2 +- api4/user_test.go | 11 ++++++++--- model/user.go | 8 +++++--- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/api4/user.go b/api4/user.go index 25984727f5..0892624ed0 100644 --- a/api4/user.go +++ b/api4/user.go @@ -86,7 +86,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) { return } - user.SanitizeInput() + user.SanitizeInput(c.IsSystemAdmin()) tokenId := r.URL.Query().Get("t") inviteId := r.URL.Query().Get("iid") diff --git a/api4/user_test.go b/api4/user_test.go index 452a045e21..003573fd09 100644 --- a/api4/user_test.go +++ b/api4/user_test.go @@ -110,10 +110,15 @@ func TestCreateUserInputFilter(t *testing.T) { _, resp := th.SystemAdminClient.CreateUser(user) CheckBadRequestStatus(t, resp) }) - - t.Run("AuthServiceFilter", func(t *testing.T) { - user := &model.User{Email: "foobar+testdomainrestriction@mattermost.org", Password: "Password1", Username: GenerateTestUsername(), AuthService: "ldap"} + t.Run("ValidAuthServiceFilter", func(t *testing.T) { + user := &model.User{Email: "foobar+testdomainrestriction@mattermost.org", Username: GenerateTestUsername(), AuthService: "ldap", AuthData: model.NewString("999099")} _, resp := th.SystemAdminClient.CreateUser(user) + CheckNoError(t, resp) + }) + + t.Run("InvalidAuthServiceFilter", func(t *testing.T) { + user := &model.User{Email: "foobar+testdomainrestriction@mattermost.org", Password: "Password1", Username: GenerateTestUsername(), AuthService: "ldap"} + _, resp := th.Client.CreateUser(user) CheckBadRequestStatus(t, resp) }) }) diff --git a/model/user.go b/model/user.go index 5a308775cc..4e04fc2954 100644 --- a/model/user.go +++ b/model/user.go @@ -497,9 +497,11 @@ func (u *User) Sanitize(options map[string]bool) { } // Remove any input data from the user object that is not user controlled -func (u *User) SanitizeInput() { - u.AuthData = NewString("") - u.AuthService = "" +func (u *User) SanitizeInput(isAdmin bool) { + if !isAdmin { + u.AuthData = NewString("") + u.AuthService = "" + } u.LastPasswordUpdate = 0 u.LastPictureUpdate = 0 u.FailedAttempts = 0