zishuo/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-10-05 08:47:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

NET-811: block normal user login from accessing dashboard (#2724)

Browse Source 
* block normal user login from accessing dashboard

* header change

* allow from ui header

* allow from ui header

* check for user role after decoding

* block oauth login for normal user

* handle other oauth provider callback funcs for user login
This commit is contained in:
Abhishek K
2023-12-20 09:08:55 +04:00
committed by GitHub
parent 72f84c1355
commit b69bf60160
7 changed files with 77 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
controllers/user.go
View File

@@ -71,6 +71,20 @@ func authenticateUser(response http.ResponseWriter, request *http.Request) {
logic.ReturnErrorResponse(response, request, errorResponse)
return
}
if val := request.Header.Get("From-Ui"); val == "true" {
// request came from UI, if normal user block Login
user, err := logic.GetUser(authRequest.UserName)
if err != nil {
logger.Log(0, authRequest.UserName, "user validation failed: ",
err.Error())
logic.ReturnErrorResponse(response, request, logic.FormatError(err, "unauthorized"))
return
}
if !(user.IsAdmin || user.IsSuperAdmin) {
logic.ReturnErrorResponse(response, request, logic.FormatError(errors.New("only admins can access dashboard"), "unauthorized"))
return
}
}
username := authRequest.UserName
jwt, err := logic.VerifyAuthRequest(authRequest)
if err != nil {
@@ -119,7 +133,7 @@ func authenticateUser(response http.ResponseWriter, request *http.Request) {
if client.OwnerID == username && !client.Enabled {
slog.Info(fmt.Sprintf("enabling ext client %s for user %s due to RAC autodisabling feature", client.ClientID, client.OwnerID))
if newClient, err := logic.ToggleExtClientConnectivity(&client, true); err != nil {
slog.Error("error disabling ext client in RAC autodisable hook", "error", err)
slog.Error("error enabling ext client in RAC autodisable hook", "error", err)
continue // dont return but try for other clients
} else {
// publish peer update to ingress gateway