darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-07-25 02:19:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

Don’t populate invite with users from other orgs

Browse Source 
We shouldn’t have a page where someone can look up any other user’s
email address based on their user ID.

We also don’t want a page where a malicious user could send someone an
link which would get them invited to the service.

Restricting the invite to be populated just from users in their own
organisation doesn’t mitigate against this stuff completely, but they
probably have a way of finding out the email address of someone in their
organisation already.
This commit is contained in:
Chris Hill-Scott
2020-06-08 14:39:36 +01:00
parent deaf2059f5
commit 92c6cca6a1
3 changed files with 65 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
tests/app/main/views/test_manage_users.py
View File

@@ -7,6 +7,8 @@ from flask import url_for
import app
from app.utils import is_gov_user
from tests.conftest import (
ORGANISATION_ID,
ORGANISATION_TWO_ID,
SERVICE_ONE_ID,
USER_ONE_ID,
create_active_user_empty_permissions,
@@ -807,13 +809,16 @@ def test_should_show_page_for_inviting_user(
def test_should_show_page_for_inviting_user_with_email_prefilled(
mocker,
client_request,
mocker,
service_one,
mock_get_template_folders,
fake_uuid,
active_user_with_permissions,
active_user_with_permission_to_other_service,
mock_get_organisation_by_domain,
):
service_one['organisation'] = ORGANISATION_ID
mocker.patch('app.models.user.user_api_client.get_user', side_effect=[
# First call is to get the current user
active_user_with_permissions,
@@ -876,6 +881,56 @@ def test_should_show_page_if_prefilled_user_is_already_a_team_member(
assert not page.select("form")
def test_should_403_if_trying_to_prefill_email_address_for_user_with_no_organisation(
mocker,
client_request,
service_one,
mock_get_template_folders,
fake_uuid,
active_user_with_permissions,
active_user_with_permission_to_other_service,
mock_get_no_organisation_by_domain,
):
service_one['organisation'] = ORGANISATION_ID
mocker.patch('app.models.user.user_api_client.get_user', side_effect=[
# First call is to get the current user
active_user_with_permissions,
# Second call gets the user to invite
active_user_with_permission_to_other_service,
])
client_request.get(
'main.invite_user',
service_id=SERVICE_ONE_ID,
user_id=fake_uuid,
_expected_status=403,
)
def test_should_403_if_trying_to_prefill_email_address_for_user_from_other_organisation(
mocker,
client_request,
service_one,
mock_get_template_folders,
fake_uuid,
active_user_with_permissions,
active_user_with_permission_to_other_service,
mock_get_organisation_by_domain,
):
service_one['organisation'] = ORGANISATION_TWO_ID
mocker.patch('app.models.user.user_api_client.get_user', side_effect=[
# First call is to get the current user
active_user_with_permissions,
# Second call gets the user to invite
active_user_with_permission_to_other_service,
])
client_request.get(
'main.invite_user',
service_id=SERVICE_ONE_ID,
user_id=fake_uuid,
_expected_status=403,
)
def test_should_show_folder_permission_form_if_service_has_folder_permissions_enabled(
client_request,
mocker,
@@ -949,13 +1004,16 @@ def test_invite_user(
def test_invite_user_when_email_address_is_prefilled(
client_request,
service_one,
active_user_with_permissions,
active_user_with_permission_to_other_service,
fake_uuid,
mocker,
sample_invite,
mock_get_template_folders,
mock_get_organisation_by_domain,
):
service_one['organisation'] = ORGANISATION_ID
mocker.patch('app.models.user.user_api_client.get_user', side_effect=[
# First call is to get the current user
active_user_with_permissions,