1
0
mirror of https://github.com/bitwarden/server.git synced 2025-04-26 15:22:19 -05:00

Fix bug where password was not validated during reset enrollment when sso config was disabled (#5677)

This commit is contained in:
Bernd Schoolmann 2025-04-21 18:21:09 +02:00 committed by GitHub
parent 735dcb7653
commit d818a271dd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -494,7 +494,7 @@ public class OrganizationUsersController : Controller
}
var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgId);
var isTdeEnrollment = ssoConfig != null && ssoConfig.GetData().MemberDecryptionType == MemberDecryptionType.TrustedDeviceEncryption;
var isTdeEnrollment = ssoConfig != null && ssoConfig.Enabled && ssoConfig.GetData().MemberDecryptionType == MemberDecryptionType.TrustedDeviceEncryption;
if (!isTdeEnrollment && !string.IsNullOrWhiteSpace(model.ResetPasswordKey) && !await _userService.VerifySecretAsync(user, model.MasterPasswordHash))
{
throw new BadRequestException("Incorrect password");