admin/n8n-enterprise-unlocked
1
0
Fork 0
mirror of https://github.com/Abdulazizzn/n8n-enterprise-unlocked.git synced 2025-12-20 03:12:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(core): Prevent non owners password reset when saml is enabled (#5788)

Browse Source 
* prevent non owners from pw reset when saml is enabled

* improve tests

* change error type
This commit is contained in:
Michael Auerswald
2023-03-30 12:44:53 +02:00
committed by GitHub
parent 9e9003bf13
commit 2216455760
2 changed files with 42 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
packages/cli/src/controllers/passwordReset.controller.ts
View File

@@ -7,6 +7,7 @@ import {
BadRequestError,
InternalServerError,
NotFoundError,
UnauthorizedError,
UnprocessableRequestError,
} from '@/ResponseHelper';
import {
@@ -24,6 +25,7 @@ import { PasswordResetRequest } from '@/requests';
import type { IDatabaseCollections, IExternalHooksClass, IInternalHooksClass } from '@/Interfaces';
import { issueCookie } from '@/auth/jwt';
import { isLdapEnabled } from '@/Ldap/helpers';
import { isSamlCurrentAuthenticationMethod } from '../sso/ssoHelpers';
@RestController()
export class PasswordResetController {
@@ -100,9 +102,18 @@ export class PasswordResetController {
email,
password: Not(IsNull()),
},
relations: ['authIdentities'],
relations: ['authIdentities', 'globalRole'],
});
if (isSamlCurrentAuthenticationMethod() && user?.globalRole.name !== 'owner') {
this.logger.debug(
'Request to send password reset email failed because login is handled by SAML',
);
throw new UnauthorizedError(
'Login is handled by SAML. Please contact your Identity Provider to reset your password.',
);
}
const ldapIdentity = user?.authIdentities?.find((i) => i.providerType === 'ldap');
if (!user?.password || (ldapIdentity && user.disabled)) {