eclipse-sailing-analytics/sailing-analytics
1
0
Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-09-22 21:55:39 +00:00
Code Activity

avoid illegal privilege escalation when deleting users/groups by granting roles with fewer qualifications

Browse Source
This commit is contained in:
Axel Uhl
2021-03-04 11:18:24 +01:00
parent a7aa41f956
commit 9b62927348
2 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sse.security.userstore.mongodb/src/com/sap/sse/security/userstore/mongodb/UserStoreImpl.java
+2 -11
View File
@@ -291,7 +291,7 @@ public class UserStoreImpl implements UserStore {
}
groupQualifierForMigratedRole = serverGroup;
}
result = new Role(roleDefinition, groupQualifierForMigratedRole, /* user qualification */ null, true);
result = new Role(roleDefinition, groupQualifierForMigratedRole, /* user qualification */ null, /* transitive */ true);
break;
}
}
@@ -1102,8 +1102,7 @@ public class UserStoreImpl implements UserStore {
removeFromUsersByAccessToken(user);
removeFromUsersByEmail(user);
removeAllQualifiedRolesForUser(user);
user.getRoles()
.forEach(role -> Util.removeFromValueSet(roleDefinitionsToUsers, role.getRoleDefinition(), user));
user.getRoles().forEach(role -> Util.removeFromValueSet(roleDefinitionsToUsers, role.getRoleDefinition(), user));
// also remove from all usergroups
LockUtil.executeWithWriteLock(userGroupsLock, () -> {
for (UserGroup userGroup : user.getUserGroups()) {
@@ -1474,10 +1473,6 @@ public class UserStoreImpl implements UserStore {
for (Role removeOrAdjust : rolesToRemoveOrAdjust) {
try {
removeRoleFromUser(checkUser.getName(), removeOrAdjust);
if (removeOrAdjust.getQualifiedForTenant() != null) {
addRoleForUser(checkUser.getName(), new Role(removeOrAdjust.getRoleDefinition(),
removeOrAdjust.getQualifiedForTenant(), null, removeOrAdjust.isTransitive()));
}
} catch (UserManagementException e) {
logger.log(Level.WARNING,
"Could not properly update qualified roles on user delete " + removeOrAdjust);
@@ -1499,10 +1494,6 @@ public class UserStoreImpl implements UserStore {
for (Role removeOrAdjust : rolesToRemoveOrAdjust) {
try {
removeRoleFromUser(checkUser.getName(), removeOrAdjust);
if (removeOrAdjust.getQualifiedForUser() != null) {
addRoleForUser(checkUser.getName(), new Role(removeOrAdjust.getRoleDefinition(), null,
removeOrAdjust.getQualifiedForUser(), removeOrAdjust.isTransitive()));
}
} catch (UserManagementException e) {
logger.log(Level.WARNING,
"Could not properly update qualified roles on userGroup delete " + removeOrAdjust);