nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 05:00:19 -05:00
Code

Wrong business logic checking for invalid permissions.

Browse Source
This commit is contained in:
Jonas Hendrickx 2025-03-26 15:01:32 +01:00
parent f6143b12d6
commit b24c25ff14
No known key found for this signature in database
GPG Key ID: C4B27F601CE4317D
3 changed files with 53 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/Core/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/SponsorshipCreation/CreateAdminInitiatedSponsorshipHandler.cs
View File

@ -28,10 +28,10 @@ public class CreateAdminInitiatedSponsorshipHandler(
OrganizationUserType[] allowedUserTypes = OrganizationUserType[] allowedUserTypes =
[ [
OrganizationUserType.Admin, OrganizationUserType.Admin,
OrganizationUserType.Owner, OrganizationUserType.Owner
OrganizationUserType.Custom
]; ];
if (!organization.Permissions.ManageUsers || allowedUserTypes.All(x => x != organization.Type))
if (!organization.Permissions.ManageUsers && allowedUserTypes.All(x => x != organization.Type))
{ {
throw new UnauthorizedAccessException("You do not have permissions to send sponsorships on behalf of the organization."); throw new UnauthorizedAccessException("You do not have permissions to send sponsorships on behalf of the organization.");
} }

12
test/Core.Test/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/CreateSponsorshipCommandTests.cs
View File

@ -211,7 +211,7 @@ public class CreateSponsorshipCommandTests : FamiliesForEnterpriseTestsBase
{ {
Id = sponsoringOrg.Id, Id = sponsoringOrg.Id,
Permissions = new Permissions(), Permissions = new Permissions(),
Type = OrganizationUserType.Admin Type = OrganizationUserType.Custom
} }
]); ]);
@ -225,6 +225,7 @@ public class CreateSponsorshipCommandTests : FamiliesForEnterpriseTestsBase
[Theory] [Theory]
[BitAutoData(OrganizationUserType.User)] [BitAutoData(OrganizationUserType.User)]
[BitAutoData(OrganizationUserType.Custom)]
public async Task CreateSponsorship_InvalidUserType_ThrowsUnauthorizedException( public async Task CreateSponsorship_InvalidUserType_ThrowsUnauthorizedException(
OrganizationUserType organizationUserType, OrganizationUserType organizationUserType,
Organization sponsoringOrg, OrganizationUser sponsoringOrgUser, User user, string sponsoredEmail, Organization sponsoringOrg, OrganizationUser sponsoringOrgUser, User user, string sponsoredEmail,
@ -248,10 +249,6 @@ public class CreateSponsorshipCommandTests : FamiliesForEnterpriseTestsBase
new() new()
{ {
Id = sponsoringOrg.Id, Id = sponsoringOrg.Id,
Permissions = new Permissions
{
ManageUsers = true,
},
Type = organizationUserType Type = organizationUserType
} }
]); ]);
@ -266,7 +263,6 @@ public class CreateSponsorshipCommandTests : FamiliesForEnterpriseTestsBase
[Theory] [Theory]
[BitAutoData(OrganizationUserType.Admin)] [BitAutoData(OrganizationUserType.Admin)]
[BitAutoData(OrganizationUserType.Custom)]
[BitAutoData(OrganizationUserType.Owner)] [BitAutoData(OrganizationUserType.Owner)]
public async Task CreateSponsorship_CreatesAdminInitiatedSponsorship( public async Task CreateSponsorship_CreatesAdminInitiatedSponsorship(
OrganizationUserType organizationUserType, OrganizationUserType organizationUserType,
@ -291,10 +287,6 @@ public class CreateSponsorshipCommandTests : FamiliesForEnterpriseTestsBase
new() new()
{ {
Id = sponsoringOrg.Id, Id = sponsoringOrg.Id,
Permissions = new Permissions
{
ManageUsers = true,
},
Type = organizationUserType Type = organizationUserType
} }
]); ]);

56
test/Core.Test/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/SponsorshipCreation/CreateAdminInitiatedSponsorshipHandlerTests.cs
View File

@ -19,8 +19,10 @@ namespace Bit.Core.Test.OrganizationFeatures.OrganizationSponsorships.FamiliesFo
public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterpriseTestsBase public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterpriseTestsBase
{ {
[Theory] [Theory]
[BitAutoData] [BitAutoData(OrganizationUserType.User)]
[BitAutoData(OrganizationUserType.Custom)]
public async Task HandleAsync_MissingManageUsersPermission_ThrowsUnauthorizedException( public async Task HandleAsync_MissingManageUsersPermission_ThrowsUnauthorizedException(
OrganizationUserType organizationUserType,
Organization sponsoringOrg, OrganizationUser sponsoringOrgUser, string sponsoredEmail, string friendlyName, Organization sponsoringOrg, OrganizationUser sponsoringOrgUser, string sponsoredEmail, string friendlyName,
Guid currentUserId, SutProvider<CreateAdminInitiatedSponsorshipHandler> sutProvider) Guid currentUserId, SutProvider<CreateAdminInitiatedSponsorshipHandler> sutProvider)
{ {
@ -37,7 +39,7 @@ public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterprise
{ {
Id = sponsoringOrg.Id, Id = sponsoringOrg.Id,
Permissions = new Permissions(), Permissions = new Permissions(),
Type = OrganizationUserType.Admin Type = organizationUserType
} }
]); ]);
@ -52,6 +54,7 @@ public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterprise
[Theory] [Theory]
[BitAutoData(OrganizationUserType.User)] [BitAutoData(OrganizationUserType.User)]
[BitAutoData(OrganizationUserType.Custom)]
public async Task HandleAsync_InvalidUserType_ThrowsUnauthorizedException( public async Task HandleAsync_InvalidUserType_ThrowsUnauthorizedException(
OrganizationUserType organizationUserType, OrganizationUserType organizationUserType,
Organization sponsoringOrg, OrganizationUser sponsoringOrgUser, string sponsoredEmail, Organization sponsoringOrg, OrganizationUser sponsoringOrgUser, string sponsoredEmail,
@ -72,7 +75,7 @@ public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterprise
Id = sponsoringOrg.Id, Id = sponsoringOrg.Id,
Permissions = new Permissions Permissions = new Permissions
{ {
ManageUsers = true, ManageUsers = false,
}, },
Type = organizationUserType Type = organizationUserType
} }
@ -89,7 +92,6 @@ public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterprise
[Theory] [Theory]
[BitAutoData(OrganizationUserType.Admin)] [BitAutoData(OrganizationUserType.Admin)]
[BitAutoData(OrganizationUserType.Custom)]
[BitAutoData(OrganizationUserType.Owner)] [BitAutoData(OrganizationUserType.Owner)]
public async Task HandleAsync_CreatesAdminInitiatedSponsorship( public async Task HandleAsync_CreatesAdminInitiatedSponsorship(
OrganizationUserType organizationUserType, Organization sponsoringOrg, OrganizationUser sponsoringOrgUser, OrganizationUserType organizationUserType, Organization sponsoringOrg, OrganizationUser sponsoringOrgUser,
@ -108,10 +110,6 @@ public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterprise
new() new()
{ {
Id = sponsoringOrg.Id, Id = sponsoringOrg.Id,
Permissions = new Permissions
{
ManageUsers = true,
},
Type = organizationUserType Type = organizationUserType
} }
]); ]);
@ -130,6 +128,48 @@ public class CreateAdminInitiatedSponsorshipHandlerTests : FamiliesForEnterprise
AssertHelper.AssertPropertyEqual(expectedSponsorship, actual); AssertHelper.AssertPropertyEqual(expectedSponsorship, actual);
} }
[Theory]
[BitAutoData(OrganizationUserType.User)]
[BitAutoData(OrganizationUserType.Custom)]
public async Task HandleAsync_CreatesAdminInitiatedSponsorshipWithValidPermissionsButInvalidOrganizationUserType(
OrganizationUserType organizationUserType, Organization sponsoringOrg, OrganizationUser sponsoringOrgUser,
string sponsoredEmail, string friendlyName, Guid currentUserId, string notes,
SutProvider<CreateAdminInitiatedSponsorshipHandler> sutProvider)
{
sponsoringOrg.PlanType = PlanType.EnterpriseAnnually;
sponsoringOrgUser.Status = OrganizationUserStatusType.Confirmed;
sutProvider.GetDependency<IFeatureService>()
.IsEnabled(Arg.Is<string>(p => p == FeatureFlagKeys.PM17772_AdminInitiatedSponsorships))
.Returns(true);
sutProvider.GetDependency<ICurrentContext>().UserId.Returns(currentUserId);
sutProvider.GetDependency<ICurrentContext>().Organizations.Returns([
new()
{
Id = sponsoringOrg.Id,
Type = organizationUserType,
Permissions =
{
ManageUsers = true
}
}
]);
var request = new CreateSponsorshipRequest(sponsoringOrg, sponsoringOrgUser,
PlanSponsorshipType.FamiliesForEnterprise, sponsoredEmail, friendlyName, notes);
var actual = await sutProvider.Sut.HandleAsync(request);
var expectedSponsorship = new OrganizationSponsorship
{
IsAdminInitiated = true,
Notes = notes
};
AssertHelper.AssertPropertyEqual(expectedSponsorship, actual);
}
[Theory] [Theory]
[BitAutoData] [BitAutoData]
public async Task HandleAsync_ThrowsBadRequestException_WhenFeatureFlagIsDisabled( public async Task HandleAsync_ThrowsBadRequestException_WhenFeatureFlagIsDisabled(