A locked user can use the API to create / delete / list cases (and more)

[0xswitch]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	CentOS,
OS version (client)	CentOS, Seven
TheHive version / git hash	2.11.3
Package Type	Binary

Problem Description

Locked user can still use the API. Even if an user is locked by the admin he still can uses the API to create an alert, a case, delete a case, get the list of the cases (certainly other actions are possible but I only tried these cases)

Steps to Reproduce

1. Go to Admin Panel > Lock the user account
2. Try to authenticate with the locked user (to be sur he is locked)
3. If the user if successfully locked try to use his credentials to call the api.
   -> curl -XDELETE -u userlocked:userlocked https://instance:port/api/case/:caseid/
4. Connect back to The Hive with a valid user and check the case which should be delected
5. The case is deleted by a locked user

Complementary information

I guess this behaviour is unwanted but may be you are already aware of this !

Thank you for your awesome solution !

[To-om]

Good spot, thanks.