vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Disable superuser functions around users when not using DB auth

Browse source
This commit is contained in:
Joseph Schorr 2015-10-16 15:14:49 -04:00
parent 2f42a4d94d
commit ad5beab3ef
2 changed files with 26 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
endpoints/api/superuser.py
View file

@ -236,6 +236,10 @@ class SuperUserList(ApiResource):
@require_scope(scopes.SUPERUSER) @require_scope(scopes.SUPERUSER)
def post(self): def post(self):
""" Creates a new user. """ """ Creates a new user. """
# Ensure that we are using database auth.
if app.config['AUTHENTICATION_TYPE'] != 'Database':
abort(400)
user_information = request.get_json() user_information = request.get_json()
if SuperUserPermission().can(): if SuperUserPermission().can():
username = user_information['username'] username = user_information['username']
@ -274,6 +278,10 @@ class SuperUserSendRecoveryEmail(ApiResource):
@nickname('sendInstallUserRecoveryEmail') @nickname('sendInstallUserRecoveryEmail')
@require_scope(scopes.SUPERUSER) @require_scope(scopes.SUPERUSER)
def post(self, username): def post(self, username):
# Ensure that we are using database auth.
if app.config['AUTHENTICATION_TYPE'] != 'Database':
abort(400)
if SuperUserPermission().can(): if SuperUserPermission().can():
user = model.user.get_nonrobot_user(username) user = model.user.get_nonrobot_user(username)
if not user: if not user:
@ -370,9 +378,17 @@ class SuperUserManagement(ApiResource):
user_data = request.get_json() user_data = request.get_json()
if 'password' in user_data: if 'password' in user_data:
# Ensure that we are using database auth.
if app.config['AUTHENTICATION_TYPE'] != 'Database':
abort(400)
model.user.change_password(user, user_data['password']) model.user.change_password(user, user_data['password'])
if 'email' in user_data: if 'email' in user_data:
# Ensure that we are using database auth.
if app.config['AUTHENTICATION_TYPE'] != 'Database':
abort(400)
model.user.update_email(user, user_data['email'], auto_verify=True) model.user.update_email(user, user_data['email'], auto_verify=True)
if 'enabled' in user_data: if 'enabled' in user_data:

14
static/partials/super-user.html
View file

@ -140,9 +140,13 @@
</div> </div>
<div ng-show="users"> <div ng-show="users">
<div class="manager-header" header-title="Users"> <div class="manager-header" header-title="Users">
<button class="create-button btn btn-primary" ng-click="showCreateUser()"> <button class="create-button btn btn-primary" ng-click="showCreateUser()"
quay-show="Config.AUTHENTICATION_TYPE == 'Database'">
<i class="fa fa-plus" style="margin-right: 6px;"></i>Create User <i class="fa fa-plus" style="margin-right: 6px;"></i>Create User
</button> </button>
<span class="co-alert co-alert-info" quay-show="Config.AUTHENTICATION_TYPE != 'Database'">
Note: <span class="registry-name"></span> is configured to use external authentication, so users can only be created in that system
</span>
</div> </div>
<div class="filter-box" collection="users" filter-model="search" filter-name="Users"></div> <div class="filter-box" collection="users" filter-model="search" filter-name="Users"></div>
@ -177,14 +181,16 @@
<td style="text-align: center;"> <td style="text-align: center;">
<span class="cor-options-menu" <span class="cor-options-menu"
ng-if="user.username != current_user.username && !current_user.super_user"> ng-if="user.username != current_user.username && !current_user.super_user">
<span class="cor-option" option-click="showChangeEmail(current_user)"> <span class="cor-option" option-click="showChangeEmail(current_user)"
quay-show="Config.AUTHENTICATION_TYPE == 'Database'">
<i class="fa fa-envelope-o"></i> Change E-mail Address <i class="fa fa-envelope-o"></i> Change E-mail Address
</span> </span>
<span class="cor-option" option-click="showChangePassword(current_user)"> <span class="cor-option" option-click="showChangePassword(current_user)"
quay-show="Config.AUTHENTICATION_TYPE == 'Database'">
<i class="fa fa-key"></i> Change Password <i class="fa fa-key"></i> Change Password
</span> </span>
<span class="cor-option" option-click="sendRecoveryEmail(current_user)" <span class="cor-option" option-click="sendRecoveryEmail(current_user)"
quay-show="Features.MAILING"> quay-show="Features.MAILING && Config.AUTHENTICATION_TYPE == 'Database'">
<i class="fa fa-envelope"></i> Send Recovery E-mail <i class="fa fa-envelope"></i> Send Recovery E-mail
</span> </span>
<span class="cor-option" option-click="showDeleteUser(current_user)"> <span class="cor-option" option-click="showDeleteUser(current_user)">