github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-14 13:33:41 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Correct permission check when revoking user API keys

Browse Source
This commit is contained in:
David Taylor 2019-12-17 10:56:16 +00:00
parent 1c49875048
commit ff4a6a37de
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/user_api_keys_controller.rb
View File

@ -164,7 +164,7 @@ class UserApiKeysController < ApplicationController
def find_key
key = UserApiKey.find(params[:id])
raise Discourse::InvalidAccess unless current_user.admin || key.user_id = current_user.id
raise Discourse::InvalidAccess unless current_user.admin || key.user_id == current_user.id
key
end

13
spec/requests/user_api_keys_controller_spec.rb
View File

@ -133,6 +133,19 @@ describe UserApiKeysController do
expect(key.revoked_at).not_to eq(nil)
end
it "will not allow revoking another users key" do
key = Fabricate(:readonly_user_api_key)
acting_user = Fabricate(:user)
sign_in(acting_user)
post "/user-api-key/revoke.json",
params: { id: key.id }
expect(response.status).to eq(403)
key.reload
expect(key.revoked_at).to eq(nil)
end
it "will not return p access if not yet configured" do
SiteSetting.min_trust_level_for_user_api_key = 0
SiteSetting.allowed_user_api_auth_redirects = args[:auth_redirect]