darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-19 14:09:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

Prevent auth type changing for any WebAuthn user

Browse Source 
Previously we applied this restriction to Platform Admins, on the
assumption that all of them use a security key to log in. Rather
than making that assumption, we can explicitly check their login
method, which also supports rolling out the feature to more users.
This commit is contained in:
Ben Thorner
2021-06-30 15:15:00 +01:00
parent 43afcd1064
commit a1b4ccc246
4 changed files with 19 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/main/views/manage_users.py
View File

@@ -142,9 +142,9 @@ def edit_user_permissions(service_id, user_id):
permissions=form.permissions,
folder_permissions=form.folder_permissions.data,
)
# only change the auth type if this is supported for a service; for Platform Admin users,
# we avoid changing the auth type to prevent it being switched to something less secure
if service_has_email_auth and not user.platform_admin:
# Only change the auth type if this is supported for a service. If a user logs in with a
# security key, we generally don't want them to be able to use something less secure.
if service_has_email_auth and not user.auth_type == 'webauthn_auth':
user.update(auth_type=form.login_authentication.data)
return redirect(url_for('.manage_users', service_id=service_id))