gsadmin/projectsend
1
0
Fork 0
mirror of https://github.com/projectsend/projectsend.git synced 2026-10-11 23:42:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Keep your own credentials behind your profile, and end tokens on a reset

Browse Source 
Your own email address, password and second factor are changed from your
profile, which asks for your current password. The staff screen and the
API changed the first two with no password at all, and the API removed
the third on your own account without the confirmation the web asks
for. StaffAccounts::ownCredentialChanges is the one rule both now ask:
the staff screen refuses your own email or password with a validation
error and points to the profile, and the API answers 403, as it does for
removing your own second factor.

Changing somebody else's password is unchanged: that is what edit_users
and edit_clients mean, on the screen and over the API. It now also
revokes that account's API tokens. Browser sessions already ended with
the password hash; tokens did not.

GHSA-j5cp-r8pr-m5cr
This commit is contained in:
ignacionelson
2026-10-03 23:05:23 -03:00
parent 7fcfbb5c41
commit db65731c3a
5 changed files with 140 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Modules/Identity/Http/Controllers/Api/UsersController.php
+17 -1
View File
@@ -182,6 +182,15 @@ class UsersController extends Controller
'assigned_clients.*' => ['integer', Rule::in($this->accounts->assignableClientIds($actor))],
]);
// Your own email address and password are changed from your
// profile, which asks for your current password. A token cannot be
// asked for one, so here the answer is no.
abort_if(
$this->accounts->ownCredentialChanges($actor, $user, $validated['email'] ?? null, $validated['password'] ?? null) !== [],
403,
__('Change your own email address and password from your profile.'),
);
// Read through Request::boolean() rather than off the validated
// array, for the reason RolesController::guardScopeRemoval spells
// out: the `boolean` rule accepts 0 and "0" as well as false but
@@ -274,7 +283,14 @@ class UsersController extends Controller
{
abort_unless($user->isStaff(), 404);
$this->accounts->guardTarget($this->actor($request), $user);
$actor = $this->actor($request);
$this->accounts->guardTarget($actor, $user);
// The web asks for your password before this (password.confirm),
// and a token cannot give one. On your own account it would let a
// token clear the second factor standing between it and a browser
// session as you.
abort_if($user->is($actor), 403, __('Remove your own two-factor authentication from your profile.'));
$twoFactor->reset($user);