public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Login: allow basic users to reset password when LDAP or Auth Proxy is enabled (#52331)

Browse Source
This commit is contained in:
Krzysztof Dąbrowski
2022-08-08 05:12:39 +00:00
committed by GitHub
parent 62b4dbf52f
commit 2dab7ad890
7 changed files with 51 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/password.go
+13 -3
View File
@@ -19,9 +19,6 @@ func (hs *HTTPServer) SendResetPasswordEmail(c *models.ReqContext) response.Resp
if err := web.Bind(c.Req, &form); err != nil {
return response.Error(http.StatusBadRequest, "bad request data", err)
}
if setting.LDAPEnabled || setting.AuthProxyEnabled {
return response.Error(401, "Not allowed to reset password when LDAP or Auth Proxy is enabled", nil)
}
if setting.DisableLoginForm {
return response.Error(401, "Not allowed to reset password when login form is disabled", nil)
}
@@ -34,6 +31,19 @@ func (hs *HTTPServer) SendResetPasswordEmail(c *models.ReqContext) response.Resp
return response.Error(http.StatusOK, "Email sent", err)
}
if usr.IsDisabled {
c.Logger.Info("Requested password reset for disabled user", "user", userQuery.LoginOrEmail)
return response.Error(http.StatusOK, "Email sent", nil)
}
getAuthQuery := models.GetAuthInfoQuery{UserId: usr.ID}
if err := hs.authInfoService.GetAuthInfo(c.Req.Context(), &getAuthQuery); err == nil {
authModule := getAuthQuery.Result.AuthModule
if authModule == models.AuthModuleLDAP || authModule == models.AuthModuleProxy {
return response.Error(401, "Not allowed to reset password for LDAP or Auth Proxy user", nil)
}
}
emailCmd := models.SendResetPasswordEmailCommand{User: usr}
if err := hs.NotificationService.SendResetPasswordEmail(c.Req.Context(), &emailCmd); err != nil {
return response.Error(500, "Failed to send email", err)