From 7daeaed13c34888e6b447717dd94090d5437a53c Mon Sep 17 00:00:00 2001 From: Jordan Brown Date: Wed, 16 Dec 2020 11:12:07 -0500 Subject: [PATCH] Better make sure users with no password can be created --- src/Tgstation.Server.Api/Models/ErrorCode.cs | 6 ++++++ src/Tgstation.Server.Host/Controllers/UserController.cs | 8 ++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/src/Tgstation.Server.Api/Models/ErrorCode.cs b/src/Tgstation.Server.Api/Models/ErrorCode.cs index abe3def22d..0b3906074f 100644 --- a/src/Tgstation.Server.Api/Models/ErrorCode.cs +++ b/src/Tgstation.Server.Api/Models/ErrorCode.cs @@ -618,5 +618,11 @@ namespace Tgstation.Server.Api.Models /// [Description("The " + Routes.UserGroup + " endpoint cannot edit group members. Please update each member user individually.")] UserGroupControllerCantEditMembers, + + /// + /// Tried to remove the last for a passwordless . + /// + [Description("This user is passwordless and removing their oAuthConnections would leave them with no authentication method!")] + CannotRemoveLastAuthenticationOption, } } diff --git a/src/Tgstation.Server.Host/Controllers/UserController.cs b/src/Tgstation.Server.Host/Controllers/UserController.cs index 81f08a66e4..579106c9c3 100644 --- a/src/Tgstation.Server.Host/Controllers/UserController.cs +++ b/src/Tgstation.Server.Host/Controllers/UserController.cs @@ -121,7 +121,8 @@ namespace Tgstation.Server.Host.Controllers if (model.OAuthConnections?.Any(x => x == null) == true) return BadRequest(new ErrorMessage(ErrorCode.ModelValidationFailure)); - if (!(model.Password == null ^ model.SystemIdentifier == null)) + if ((model.Password != null && model.SystemIdentifier != null) + || (model.Password == null && model.SystemIdentifier == null && model.OAuthConnections?.Any() != true)) return BadRequest(new ErrorMessage(ErrorCode.UserMismatchPasswordSid)); if (model.Group != null && model.PermissionSet != null) @@ -155,7 +156,7 @@ namespace Tgstation.Server.Host.Controllers { return RequiresPosixSystemIdentity(); } - else if (!(model.Password?.Length == 0 && model.OAuthConnections.Count != 0)) + else if (!(model.Password?.Length == 0 && model.OAuthConnections?.Any() == true)) { var result = TrySetPassword(dbUser, model.Password, true); if (result != null) @@ -261,6 +262,9 @@ namespace Tgstation.Server.Host.Controllers if (originalUser.CanonicalName == Models.User.CanonicalizeName(Api.Models.User.AdminName)) return BadRequest(new ErrorMessage(ErrorCode.AdminUserCannotOAuth)); + if (model.OAuthConnections.Count == 0 && originalUser.PasswordHash == null && originalUser.SystemIdentifier == null) + return BadRequest(new ErrorMessage(ErrorCode.CannotRemoveLastAuthenticationOption)); + originalUser.OAuthConnections.Clear(); foreach (var updatedConnection in model.OAuthConnections) originalUser.OAuthConnections.Add(new Models.OAuthConnection