nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-06-30 07:36:14 -05:00
Code Activity

Add a master password hash check to account recovery enrollment (#4154)

Browse Source
This commit is contained in:
Addison Beck
2024-07-01 11:52:58 -04:00
committed by GitHub
parent 5fcd281d96
commit e2d2a2ba90
3 changed files with 36 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/Api/AdminConsole/Controllers/OrganizationUsersController.cs
View File

@ -456,6 +456,11 @@ public class OrganizationUsersController : Controller
throw new UnauthorizedAccessException();
}
if (!string.IsNullOrWhiteSpace(model.ResetPasswordKey) && !await _userService.VerifySecretAsync(user, model.Secret))
{
throw new BadRequestException("Incorrect password");
}
var callingUserId = user.Id;
await _organizationService.UpdateUserResetPasswordEnrollmentAsync(
orgId, userId, model.ResetPasswordKey, callingUserId);

3
src/Api/AdminConsole/Models/Request/Organizations/OrganizationUserRequestModels.cs
View File

@ -1,4 +1,5 @@
using System.ComponentModel.DataAnnotations;
using Bit.Api.Auth.Models.Request.Accounts;
using Bit.Api.Models.Request;
using Bit.Core.Entities;
using Bit.Core.Enums;
@ -98,7 +99,7 @@ public class OrganizationUserUpdateRequestModel
}
}
public class OrganizationUserResetPasswordEnrollmentRequestModel
public class OrganizationUserResetPasswordEnrollmentRequestModel : SecretVerificationRequestModel
{
public string ResetPasswordKey { get; set; }
}