mirror of
https://github.com/bitwarden/server.git
synced 2025-06-30 15:42:48 -05:00
[PM-19357] - [Defect] Unauthorised access allows limited access user to change custom hidden field of Items (#5572)
* prevent hidden password users from modifying hidden fields * add tests * fix serialization issues * DRY up code * return newly created cipher * add sshKey data type * fix tests
This commit is contained in:
@ -177,12 +177,7 @@ public class CiphersController : Controller
|
||||
}
|
||||
|
||||
await _cipherService.SaveDetailsAsync(cipher, user.Id, model.Cipher.LastKnownRevisionDate, model.CollectionIds, cipher.OrganizationId.HasValue);
|
||||
var response = new CipherResponseModel(
|
||||
cipher,
|
||||
user,
|
||||
await _applicationCacheService.GetOrganizationAbilitiesAsync(),
|
||||
_globalSettings);
|
||||
return response;
|
||||
return await Get(cipher.Id);
|
||||
}
|
||||
|
||||
[HttpPost("admin")]
|
||||
|
Reference in New Issue
Block a user