Skip to content

Commit 6b51b23

Browse files
janusec2janusec2
committed
fix oauth2 users privileges, merge branch 'dev'
2 parents 3e10781 + a1f3703 commit 6b51b23

9 files changed

+102
-63
lines changed

‎backend/application.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ func LoadAppDomainNames() {
220220

221221
// GetApplications ...
222222
func GetApplications(authUser *models.AuthUser) ([]*models.Application, error) {
223-
if authUser.IsAppAdmin {
223+
if authUser.IsAppAdmin || authUser.IsSuperAdmin {
224224
return Apps, nil
225225
}
226226
myApps := []*models.Application{}

‎data/backend_appuser.go

+1
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ func (dal *MyDAL) SelectAppUserByName(username string) *models.AppUser {
8686
&appUser.NeedModifyPWD)
8787
if err != nil {
8888
utils.DebugPrintln("SelectAppUserByName", err)
89+
return nil
8990
}
9091
return appUser
9192
}

‎usermgmt/ldap.go

+16-10
Original file line numberDiff line numberDiff line change
@@ -139,21 +139,27 @@ func LDAPAuthFunc(w http.ResponseWriter, r *http.Request) {
139139
}
140140
// Janusec admin user
141141
if state == "admin" {
142-
// Insert into db if not existed
143-
id, err := data.DAL.InsertIfNotExistsAppUser(username, "", "", "", false, false, false, false)
144-
if err != nil {
145-
w.WriteHeader(403)
146-
w.Write([]byte("Error: " + err.Error()))
147-
return
142+
appUser := data.DAL.SelectAppUserByName(username)
143+
var userID int64
144+
if appUser == nil {
145+
// Insert into db if not existed
146+
userID, err = data.DAL.InsertIfNotExistsAppUser(username, "", "", "", false, false, false, false)
147+
if err != nil {
148+
w.WriteHeader(403)
149+
w.Write([]byte("Error: " + err.Error()))
150+
return
151+
}
152+
} else {
153+
userID = appUser.ID
148154
}
149155
// create session
150156
authUser := &models.AuthUser{
151-
UserID: id,
157+
UserID: userID,
152158
Username: username,
153159
Logged: true,
154-
IsSuperAdmin: false,
155-
IsCertAdmin: false,
156-
IsAppAdmin: false,
160+
IsSuperAdmin: appUser.IsSuperAdmin,
161+
IsCertAdmin: appUser.IsCertAdmin,
162+
IsAppAdmin: appUser.IsAppAdmin,
157163
NeedModifyPWD: false}
158164
session, _ := store.Get(r, "sessionid")
159165
session.Values["authuser"] = authUser

‎usermgmt/oauth_cas2.go

+16-11
Original file line numberDiff line numberDiff line change
@@ -68,22 +68,27 @@ func CAS2CallbackWithCode(w http.ResponseWriter, r *http.Request) {
6868
casUser := casServiceResponse.AuthenticationSuccess.CASUser
6969

7070
if state == "admin" {
71-
// To do: for janusec-admin
72-
// Insert into db if not existed
73-
id, err := data.DAL.InsertIfNotExistsAppUser(casUser, "", "", "", false, false, false, false)
74-
if err != nil {
75-
w.WriteHeader(403)
76-
w.Write([]byte("Error: " + err.Error()))
77-
return
71+
appUser := data.DAL.SelectAppUserByName(casUser)
72+
var userID int64
73+
if appUser == nil {
74+
// Insert into db if not existed
75+
userID, err = data.DAL.InsertIfNotExistsAppUser(casUser, "", "", "", false, false, false, false)
76+
if err != nil {
77+
w.WriteHeader(403)
78+
w.Write([]byte("Error: " + err.Error()))
79+
return
80+
}
81+
} else {
82+
userID = appUser.ID
7883
}
7984
// create session
8085
authUser := &models.AuthUser{
81-
UserID: id,
86+
UserID: userID,
8287
Username: casUser,
8388
Logged: true,
84-
IsSuperAdmin: false,
85-
IsCertAdmin: false,
86-
IsAppAdmin: false,
89+
IsSuperAdmin: appUser.IsSuperAdmin,
90+
IsCertAdmin: appUser.IsCertAdmin,
91+
IsAppAdmin: appUser.IsAppAdmin,
8792
NeedModifyPWD: false}
8893
session, _ := store.Get(r, "sessionid")
8994
session.Values["authuser"] = authUser

‎usermgmt/oauth_dingtalk.go

+16-10
Original file line numberDiff line numberDiff line change
@@ -82,21 +82,27 @@ func DingtalkCallbackWithCode(w http.ResponseWriter, r *http.Request) {
8282
}
8383
dingtalkUser := dingtalkResponse.UserInfo
8484
if state == "admin" {
85-
// Insert into db if not existed
86-
id, err := data.DAL.InsertIfNotExistsAppUser(dingtalkUser.Nick, "", "", "", false, false, false, false)
87-
if err != nil {
88-
w.WriteHeader(403)
89-
w.Write([]byte("Error: " + err.Error()))
90-
return
85+
appUser := data.DAL.SelectAppUserByName(dingtalkUser.Nick)
86+
var userID int64
87+
if appUser == nil {
88+
// Insert into db if not existed
89+
userID, err = data.DAL.InsertIfNotExistsAppUser(dingtalkUser.Nick, "", "", "", false, false, false, false)
90+
if err != nil {
91+
w.WriteHeader(403)
92+
w.Write([]byte("Error: " + err.Error()))
93+
return
94+
}
95+
} else {
96+
userID = appUser.ID
9197
}
9298
// create session
9399
authUser := &models.AuthUser{
94-
UserID: id,
100+
UserID: userID,
95101
Username: dingtalkUser.Nick,
96102
Logged: true,
97-
IsSuperAdmin: false,
98-
IsCertAdmin: false,
99-
IsAppAdmin: false,
103+
IsSuperAdmin: appUser.IsSuperAdmin,
104+
IsCertAdmin: appUser.IsCertAdmin,
105+
IsAppAdmin: appUser.IsAppAdmin,
100106
NeedModifyPWD: false}
101107
session, _ := store.Get(r, "sessionid")
102108
session.Values["authuser"] = authUser

‎usermgmt/oauth_feishu.go

+16-10
Original file line numberDiff line numberDiff line change
@@ -97,21 +97,27 @@ func FeishuCallbackWithCode(w http.ResponseWriter, r *http.Request) {
9797
utils.DebugPrintln("FeishuCallbackWithCode json.Unmarshal error", err)
9898
}
9999
if state == "admin" {
100-
// Insert into db if not existed
101-
id, err := data.DAL.InsertIfNotExistsAppUser(feishuUser.Data.EnName, "", "", "", false, false, false, false)
102-
if err != nil {
103-
w.WriteHeader(403)
104-
w.Write([]byte("Error: " + err.Error()))
105-
return
100+
appUser := data.DAL.SelectAppUserByName(feishuUser.Data.EnName)
101+
var userID int64
102+
if appUser == nil {
103+
// Insert into db if not existed
104+
userID, err = data.DAL.InsertIfNotExistsAppUser(feishuUser.Data.EnName, "", "", "", false, false, false, false)
105+
if err != nil {
106+
w.WriteHeader(403)
107+
w.Write([]byte("Error: " + err.Error()))
108+
return
109+
}
110+
} else {
111+
userID = appUser.ID
106112
}
107113
// create session
108114
authUser := &models.AuthUser{
109-
UserID: id,
115+
UserID: userID,
110116
Username: feishuUser.Data.EnName,
111117
Logged: true,
112-
IsSuperAdmin: false,
113-
IsCertAdmin: false,
114-
IsAppAdmin: false,
118+
IsSuperAdmin: appUser.IsSuperAdmin,
119+
IsCertAdmin: appUser.IsCertAdmin,
120+
IsAppAdmin: appUser.IsAppAdmin,
115121
NeedModifyPWD: false}
116122
session, _ := store.Get(r, "sessionid")
117123
session.Values["authuser"] = authUser

‎usermgmt/oauth_lark.go

+16-10
Original file line numberDiff line numberDiff line change
@@ -103,21 +103,27 @@ func LarkCallbackWithCode(w http.ResponseWriter, r *http.Request) {
103103
utils.DebugPrintln("LarkCallbackWithCode json.Unmarshal error", err)
104104
}
105105
if state == "admin" {
106-
// Insert into db if not existed
107-
id, err := data.DAL.InsertIfNotExistsAppUser(larkUser.Data.EnName, "", "", "", false, false, false, false)
108-
if err != nil {
109-
w.WriteHeader(403)
110-
w.Write([]byte("Error: " + err.Error()))
111-
return
106+
appUser := data.DAL.SelectAppUserByName(larkUser.Data.EnName)
107+
var userID int64
108+
if appUser == nil {
109+
// Insert into db if not existed
110+
userID, err = data.DAL.InsertIfNotExistsAppUser(larkUser.Data.EnName, "", "", "", false, false, false, false)
111+
if err != nil {
112+
w.WriteHeader(403)
113+
w.Write([]byte("Error: " + err.Error()))
114+
return
115+
}
116+
} else {
117+
userID = appUser.ID
112118
}
113119
// create session
114120
authUser := &models.AuthUser{
115-
UserID: id,
121+
UserID: userID,
116122
Username: larkUser.Data.EnName,
117123
Logged: true,
118-
IsSuperAdmin: false,
119-
IsCertAdmin: false,
120-
IsAppAdmin: false,
124+
IsSuperAdmin: appUser.IsSuperAdmin,
125+
IsCertAdmin: appUser.IsCertAdmin,
126+
IsAppAdmin: appUser.IsAppAdmin,
121127
NeedModifyPWD: false}
122128
session, _ := store.Get(r, "sessionid")
123129
session.Values["authuser"] = authUser

‎usermgmt/oauth_wxwork.go

+16-10
Original file line numberDiff line numberDiff line change
@@ -74,21 +74,27 @@ func WxworkCallbackWithCode(w http.ResponseWriter, r *http.Request) {
7474
utils.DebugPrintln("WxworkCallbackWithCode json.Unmarshal error", err)
7575
}
7676
if state == "admin" {
77-
// Insert into db if not existed
78-
id, err := data.DAL.InsertIfNotExistsAppUser(wxworkUser.UserID, "", "", "", false, false, false, false)
79-
if err != nil {
80-
w.WriteHeader(403)
81-
w.Write([]byte("Error: " + err.Error()))
82-
return
77+
appUser := data.DAL.SelectAppUserByName(wxworkUser.UserID)
78+
var userID int64
79+
if appUser == nil {
80+
// Insert into db if not existed
81+
userID, err = data.DAL.InsertIfNotExistsAppUser(wxworkUser.UserID, "", "", "", false, false, false, false)
82+
if err != nil {
83+
w.WriteHeader(403)
84+
w.Write([]byte("Error: " + err.Error()))
85+
return
86+
}
87+
} else {
88+
userID = appUser.ID
8389
}
8490
// create session
8591
authUser := &models.AuthUser{
86-
UserID: id,
92+
UserID: userID,
8793
Username: wxworkUser.UserID,
8894
Logged: true,
89-
IsSuperAdmin: false,
90-
IsCertAdmin: false,
91-
IsAppAdmin: false,
95+
IsSuperAdmin: appUser.IsSuperAdmin,
96+
IsCertAdmin: appUser.IsCertAdmin,
97+
IsAppAdmin: appUser.IsAppAdmin,
9298
NeedModifyPWD: false}
9399
session, _ := store.Get(r, "sessionid")
94100
session.Values["authuser"] = authUser

‎usermgmt/usermgmt.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,10 @@ func Login(w http.ResponseWriter, r *http.Request, body []byte, clientIP string)
5252
}
5353
loginUser := apiLoginUserRequest.Object
5454
appUser := data.DAL.SelectAppUserByName(loginUser.Username)
55-
55+
if appUser == nil {
56+
// not exists
57+
return nil, errors.New("wrong authentication credentials")
58+
}
5659
tmpHashpwd := data.SHA256Hash(loginUser.Password + appUser.Salt)
5760
if tmpHashpwd != appUser.HashPwd {
5861
return nil, errors.New("wrong authentication credentials")

0 commit comments

Comments
 (0)