github
/
portainer
mirror of https://github.com/portainer/portainer
1
0
Fork 0
Code Issues Releases Wiki Activity

fix(user-token): prevent admin read tokens of other admins EE-5858 (#10489)

pull/10445/head
cmeng 2023-10-19 16:23:14 +13:00 committed by GitHub
parent 03155685ab
commit bc0050a7b4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
api/http/handler/users/user_get_access_tokens.go
View File

@ -33,16 +33,7 @@ func (handler *Handler) userGetAccessTokens(w http.ResponseWriter, r *http.Reque
return httperror.BadRequest("Invalid user identifier route variable", err)
}
tokenData, err := security.RetrieveTokenData(r)
if err != nil {
return httperror.InternalServerError("Unable to retrieve user authentication token", err)
}
if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
return httperror.Forbidden("Permission denied to get user access tokens", httperrors.ErrUnauthorized)
}
_, err = handler.DataStore.User().Read(portainer.UserID(userID))
user, err := handler.DataStore.User().Read(portainer.UserID(userID))
if err != nil {
if handler.DataStore.IsErrObjectNotFound(err) {
return httperror.NotFound("Unable to find a user with the specified identifier inside the database", err)
@ -50,6 +41,15 @@ func (handler *Handler) userGetAccessTokens(w http.ResponseWriter, r *http.Reque
return httperror.InternalServerError("Unable to find a user with the specified identifier inside the database", err)
}
tokenData, err := security.RetrieveTokenData(r)
if err != nil {
return httperror.InternalServerError("Unable to retrieve user authentication token", err)
}
if tokenData.ID != portainer.UserID(userID) && (tokenData.Role != portainer.AdministratorRole || user.Role == portainer.AdministratorRole) {
return httperror.Forbidden("Permission denied to get user access tokens", httperrors.ErrUnauthorized)
}
apiKeys, err := handler.apiKeyService.GetAPIKeys(portainer.UserID(userID))
if err != nil {
return httperror.InternalServerError("Internal Server Error", err)