sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Forbid to remove own user account

Browse Source 
And admin user is no longer allowed to remove its own user account.
This to prevent admins from locking themselves out.

Fixes: #3713
This commit is contained in:
Ralf Haferkamp
2022-09-23 09:13:46 +02:00
parent 87eaf72020
commit cc53071f63
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/graph/pkg/service/v0/users.go
+11
View File
@@ -255,6 +255,7 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
userID := chi.URLParam(r, "userID")
userID, err := url.PathUnescape(userID)
if err != nil {
g.logger.Debug().Err(err).Msg("unescaping user id failed")
errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, "unescaping user id failed")
return
}
@@ -265,6 +266,7 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
}
user, err := g.identityBackend.GetUser(r.Context(), userID, r.URL.Query())
if err != nil {
g.logger.Debug().Err(err).Str("userID", userID).Msg("failed to get user")
var errcode errorcode.Error
if errors.As(err, &errcode) {
errcode.Render(w, r)
@@ -276,6 +278,12 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
currentUser := ctxpkg.ContextMustGetUser(r.Context())
if currentUser.GetId().GetOpaqueId() == user.GetId() {
g.logger.Debug().Msg("self deletion forbidden")
errorcode.NotAllowed.Render(w, r, http.StatusForbidden, "self deletion forbidden")
return
}
opaque := utils.AppendPlainToOpaque(nil, "unrestricted", "T")
f := listStorageSpacesUserFilter(user.GetId())
lspr, err := g.gatewayClient.ListStorageSpaces(r.Context(), &storageprovider.ListStorageSpacesRequest{
@@ -283,6 +291,7 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
Filters: []*storageprovider.ListStorageSpacesRequest_Filter{f},
})
if err != nil {
g.logger.Debug().Err(err).Msg("could not read spaces")
errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, "could not read spaces")
return
}
@@ -303,6 +312,7 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
},
})
if err != nil {
g.logger.Debug().Err(err).Msg("could not disable homespace")
errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, "could not disable homespace")
return
}
@@ -315,6 +325,7 @@ func (g Graph) DeleteUser(w http.ResponseWriter, r *http.Request) {
},
})
if err != nil {
g.logger.Debug().Err(err).Msg("could not delete homespace")
errorcode.InvalidRequest.Render(w, r, http.StatusBadRequest, "could not delete homespace")
return
}