detleph/server
1
0
Fork 0
mirror of https://github.com/detleph/server.git synced 2026-09-04 08:36:06 +02:00
Code Issues 9 Packages Projects Releases Wiki Activity

Change the controller for changing passwords to use PIDs and not usernames

Browse Source
This commit is contained in:
Stephan
2022-01-02 15:46:47 +01:00
parent 5b02905d71
commit cc1c394dce
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Controllers/admin.controller.ts
+8 -8
View File
@@ -123,16 +123,16 @@ export const createAdmin = async (req: Request<{}, {}, CreateAdminBody>, res: Re
};
interface UpdatePasswordBody {
name?: string;
pid?: string;
password?: string;
new_password: string;
}
// Expects a valid username (Should be tested beforehand)
const updatePasswordField = async (name: string, new_password: string) => {
const updatePasswordField = async (pid: string, new_password: string) => {
const new_password_hash = await argon2.hash(new_password, { type: argon2.argon2id });
await prisma.admin.updateMany({ where: { name }, data: { password: new_password_hash } });
await prisma.admin.update({ where: { pid }, data: { password: new_password_hash } });
};
// requires: auth
@@ -141,7 +141,7 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
return res.status(500).json(AUTH_ERROR);
}
const name = req.body.name || req.auth.name;
const pid = req.body.pid || req.auth.pid;
if (typeof req.body.new_password !== "string") {
return res.status(400).json({
@@ -157,7 +157,7 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
});
}
const user_to_upate = await prisma.admin.findFirst({ where: { name } });
const user_to_upate = await prisma.admin.findUnique({ where: { pid } });
if (!user_to_upate) {
// REVIEW: This allows potential attackers (which are authorized with some account)
@@ -171,12 +171,12 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
}
if (req.auth.permission_level == "ELEVATED" && user_to_upate.permission_level == "STANDARD") {
updatePasswordField(name, req.body.new_password);
updatePasswordField(pid, req.body.new_password);
res.status(200).json({
type: "success",
});
} else if (req.auth.name === name) {
} else if (req.auth.pid === pid) {
if (typeof req.body.password !== "string") {
return res.status(400).json({
type: "error",
@@ -191,7 +191,7 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
}
if (await argon2.verify(user_to_upate.password, req.body.password, { type: argon2.argon2id })) {
updatePasswordField(name, req.body.new_password);
updatePasswordField(pid, req.body.new_password);
return res.status(200).json({
type: "success",