detleph/server
1
0
Fork 0
mirror of https://github.com/detleph/server.git synced 2026-09-04 08:36:06 +02:00
Code Issues 9 Packages Projects Releases Wiki Activity

Change the controller for changing passwords to use PIDs and not usernames

Browse Source
This commit is contained in:
Stephan
2022-04-28 12:49:07 +02:00
committed by Stefan-5422
parent 94ce50aaf1
commit ff9d5b7912
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Controllers/admin.controller.ts
+8 -8
View File
@@ -123,16 +123,16 @@ export const createAdmin = async (req: Request<{}, {}, CreateAdminBody>, res: Re
}; };
interface UpdatePasswordBody { interface UpdatePasswordBody {
name?: string; pid?: string;
password?: string; password?: string;
new_password: string; new_password: string;
} }
// Expects a valid username (Should be tested beforehand) // Expects a valid username (Should be tested beforehand)
const updatePasswordField = async (name: string, new_password: string) => { const updatePasswordField = async (pid: string, new_password: string) => {
const new_password_hash = await argon2.hash(new_password, { type: argon2.argon2id }); const new_password_hash = await argon2.hash(new_password, { type: argon2.argon2id });
await prisma.admin.updateMany({ where: { name }, data: { password: new_password_hash } }); await prisma.admin.update({ where: { pid }, data: { password: new_password_hash } });
}; };
// requires: auth // requires: auth
@@ -141,7 +141,7 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
return res.status(500).json(AUTH_ERROR); return res.status(500).json(AUTH_ERROR);
} }
const name = req.body.name || req.auth.name; const pid = req.body.pid || req.auth.pid;
if (typeof req.body.new_password !== "string") { if (typeof req.body.new_password !== "string") {
return res.status(400).json({ return res.status(400).json({
@@ -157,7 +157,7 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
}); });
} }
const user_to_upate = await prisma.admin.findFirst({ where: { name } }); const user_to_upate = await prisma.admin.findUnique({ where: { pid } });
if (!user_to_upate) { if (!user_to_upate) {
// REVIEW: This allows potential attackers (which are authorized with some account) // REVIEW: This allows potential attackers (which are authorized with some account)
@@ -171,12 +171,12 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
} }
if (req.auth.permission_level == "ELEVATED" && user_to_upate.permission_level == "STANDARD") { if (req.auth.permission_level == "ELEVATED" && user_to_upate.permission_level == "STANDARD") {
updatePasswordField(name, req.body.new_password); updatePasswordField(pid, req.body.new_password);
res.status(200).json({ res.status(200).json({
type: "success", type: "success",
}); });
} else if (req.auth.name === name) { } else if (req.auth.pid === pid) {
if (typeof req.body.password !== "string") { if (typeof req.body.password !== "string") {
return res.status(400).json({ return res.status(400).json({
type: "error", type: "error",
@@ -191,7 +191,7 @@ export const updatePassword = async (req: Request<{}, {}, UpdatePasswordBody>, r
} }
if (await argon2.verify(user_to_upate.password, req.body.password, { type: argon2.argon2id })) { if (await argon2.verify(user_to_upate.password, req.body.password, { type: argon2.argon2id })) {
updatePasswordField(name, req.body.new_password); updatePasswordField(pid, req.body.new_password);
return res.status(200).json({ return res.status(200).json({
type: "success", type: "success",