#2008 Admin must have permission on all user's organisation to set hi…

…s password
TheHive-Project · May 10, 2021 · 937eee1 · 937eee1
1 parent 0f693b9
commit 937eee1
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 17 deletions.
diff --git a/thehive/app/org/thp/thehive/controllers/v0/UserCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/UserCtrl.scala
@@ -126,17 +126,17 @@ class UserCtrl @Inject() (
       .auth { implicit request =>
         for {
           user <- db.roTransaction { implicit graph =>
-            userSrv
-              .get(EntityIdOrName(userId))
-              .getOrFail("User")
-              .flatMap { u =>
-                userSrv
-                  .current
-                  .organisations(Permissions.manageUser)
-                  .users
-                  .getEntity(u)
-                  .getOrFail("User")
-              }
+            if (
+              userSrv
+                .get(EntityIdOrName(userId))
+                .organisations
+                .filterNot(_.users(Permissions.manageUser).current)
+                .exists && !userSrv.current.organisations(Permissions.manageUser).isAdmin
+            ) Failure(AuthorizationError("You are not authorized to set password of this user"))
+            else
+              userSrv
+                .get(EntityIdOrName(userId))
+                .getOrFail("User")
           }
           _ <- authSrv.setPassword(userId, request.body("password"))
           _ <- db.tryTransaction(implicit graph => auditSrv.user.update(user, Json.obj("password" -> "<hidden>")))

diff --git a/thehive/app/org/thp/thehive/controllers/v1/UserCtrl.scala b/thehive/app/org/thp/thehive/controllers/v1/UserCtrl.scala
@@ -233,12 +233,17 @@ class UserCtrl @Inject() (
       .auth { implicit request =>
         for {
           user <- db.roTransaction { implicit graph =>
-            userSrv
-              .current
-              .organisations(Permissions.manageUser)
-              .users
-              .get(EntityIdOrName(userIdOrName))
-              .getOrFail("User")
+            if (
+              userSrv
+                .get(EntityIdOrName(userIdOrName))
+                .organisations
+                .filterNot(_.users(Permissions.manageUser).current)
+                .exists && !userSrv.current.organisations(Permissions.manageUser).isAdmin
+            ) Failure(AuthorizationError("You are not authorized to set password of this user"))
+            else
+              userSrv
+                .get(EntityIdOrName(userIdOrName))
+                .getOrFail("User")
           }
           _ <- authSrv.setPassword(user.login, request.body("password"))
           _ <- db.tryTransaction(implicit graph => auditSrv.user.update(user, Json.obj("password" -> "<hidden>")))