[#1427] Extra check that admin OAuth scope is used by admin. Adjusted tests.

This commit is contained in:
Ivan Tashkinov 2019-12-07 17:49:53 +03:00
parent 40e1817f70
commit 1770602747
4 changed files with 67 additions and 27 deletions

View File

@ -6,29 +6,37 @@ defmodule Pleroma.Plugs.UserIsAdminPlug do
import Pleroma.Web.TranslationHelpers import Pleroma.Web.TranslationHelpers
import Plug.Conn import Plug.Conn
alias Pleroma.User
alias Pleroma.Web.OAuth alias Pleroma.Web.OAuth
def init(options) do def init(options) do
options options
end end
def call(%Plug.Conn{assigns: assigns} = conn, _) do def call(%{assigns: %{user: %User{is_admin: true}} = assigns} = conn, _) do
token = assigns[:token] token = assigns[:token]
user = assigns[:user]
cond do cond do
not Pleroma.Config.enforce_oauth_admin_scope_usage?() ->
conn
token && OAuth.Scopes.contains_admin_scopes?(token.scopes) -> token && OAuth.Scopes.contains_admin_scopes?(token.scopes) ->
# Note: checking for _any_ admin scope presence, not necessarily fitting requested action. # Note: checking for _any_ admin scope presence, not necessarily fitting requested action.
# Thus, controller must explicitly invoke OAuthScopesPlug to verify scope requirements. # Thus, controller must explicitly invoke OAuthScopesPlug to verify scope requirements.
conn conn
user && user.is_admin && !Pleroma.Config.enforce_oauth_admin_scope_usage?() ->
conn
true -> true ->
fail(conn)
end
end
def call(conn, _) do
fail(conn)
end
defp fail(conn) do
conn conn
|> render_error(:forbidden, "User is not an admin or OAuth admin scope is not granted.") |> render_error(:forbidden, "User is not an admin or OAuth admin scope is not granted.")
|> halt() |> halt()
end end
end
end end

View File

@ -1736,7 +1736,8 @@ def admin_api_update(user, params) do
with {:ok, updated_user} <- update_and_set_cache(changeset) do with {:ok, updated_user} <- update_and_set_cache(changeset) do
if user.is_admin && !updated_user.is_admin do if user.is_admin && !updated_user.is_admin do
# Tokens & authorizations containing any admin scopes must be revoked (revoking all) # Tokens & authorizations containing any admin scopes must be revoked (revoking all).
# This is an extra safety measure (tokens' admin scopes won't be accepted for non-admins).
global_sign_out(user) global_sign_out(user)
end end

View File

@ -13,7 +13,7 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false) Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
end end
test "accepts a user that is admin" do test "accepts a user that is an admin" do
user = insert(:user, is_admin: true) user = insert(:user, is_admin: true)
conn = assign(build_conn(), :user, user) conn = assign(build_conn(), :user, user)
@ -23,7 +23,7 @@ test "accepts a user that is admin" do
assert conn == ret_conn assert conn == ret_conn
end end
test "denies a user that isn't admin" do test "denies a user that isn't an admin" do
user = insert(:user) user = insert(:user)
conn = conn =
@ -54,23 +54,43 @@ test "denies when a user isn't set" do
{:ok, %{users: [admin_user, non_admin_user, blank_user]}} {:ok, %{users: [admin_user, non_admin_user, blank_user]}}
end end
# Note: in real-life scenarios only users with is_admin flag can possess admin-scoped tokens; test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
# however, the following test stresses out that is_admin flag is not checked if we got token user = insert(:user, is_admin: true)
test "if token has any of admin scopes, accepts users regardless of is_admin flag",
%{users: users} do
for user <- users do
token = insert(:oauth_token, user: user, scopes: ["admin:something"]) token = insert(:oauth_token, user: user, scopes: ["admin:something"])
conn = conn =
build_conn() conn
|> assign(:user, user) |> assign(:user, user)
|> assign(:token, token) |> assign(:token, token)
|> UserIsAdminPlug.call(%{})
ret_conn = UserIsAdminPlug.call(conn, %{}) ret_conn = UserIsAdminPlug.call(conn, %{})
assert conn == ret_conn assert conn == ret_conn
end end
test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
user = insert(:user, is_admin: false)
token = insert(:oauth_token, user: user, scopes: ["admin:something"])
conn =
conn
|> assign(:user, user)
|> assign(:token, token)
|> UserIsAdminPlug.call(%{})
assert conn.status == 403
end
test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
token = insert(:oauth_token, scopes: ["admin:something"])
conn =
conn
|> assign(:user, nil)
|> assign(:token, token)
|> UserIsAdminPlug.call(%{})
assert conn.status == 403
end end
test "if token lacks admin scopes, denies users regardless of is_admin flag", test "if token lacks admin scopes, denies users regardless of is_admin flag",

View File

@ -36,6 +36,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or broader scope" do test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or broader scope" do
user = insert(:user) user = insert(:user)
admin = insert(:user, is_admin: true) admin = insert(:user, is_admin: true)
url = "/api/pleroma/admin/users/#{user.nickname}"
good_token1 = insert(:oauth_token, user: admin, scopes: ["admin"]) good_token1 = insert(:oauth_token, user: admin, scopes: ["admin"])
good_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read"]) good_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read"])
@ -50,17 +51,27 @@ test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or bro
build_conn() build_conn()
|> assign(:user, admin) |> assign(:user, admin)
|> assign(:token, good_token) |> assign(:token, good_token)
|> get("/api/pleroma/admin/users/#{user.nickname}") |> get(url)
assert json_response(conn, 200) assert json_response(conn, 200)
end end
for good_token <- [good_token1, good_token2, good_token3] do
conn =
build_conn()
|> assign(:user, nil)
|> assign(:token, good_token)
|> get(url)
assert json_response(conn, :forbidden)
end
for bad_token <- [bad_token1, bad_token2, bad_token3] do for bad_token <- [bad_token1, bad_token2, bad_token3] do
conn = conn =
build_conn() build_conn()
|> assign(:user, admin) |> assign(:user, admin)
|> assign(:token, bad_token) |> assign(:token, bad_token)
|> get("/api/pleroma/admin/users/#{user.nickname}") |> get(url)
assert json_response(conn, :forbidden) assert json_response(conn, :forbidden)
end end