|
 |
308b85 |
From 5aa2c77ac1ac544ed6b3a2c5efa767e53b810c3b Mon Sep 17 00:00:00 2001
|
|
|
308b85 |
From: linoman <2051016+linoman@users.noreply.github.com>
|
|
|
308b85 |
Date: Fri, 16 Sep 2022 10:46:44 +0200
|
|
|
308b85 |
Subject: [PATCH] fix CVE-2022-39229
|
|
|
308b85 |
|
|
|
308b85 |
Swap order of login fields
|
|
|
308b85 |
|
|
|
308b85 |
(cherry picked from commit 5ec176cada3d8adf651f844e3f707bc469495abd)
|
|
|
308b85 |
|
|
|
308b85 |
Add test for username/login field conflict
|
|
|
308b85 |
|
|
|
308b85 |
(cherry picked from commit 7aabcf26944835b0418eec6b057a0b186ff206bf)
|
|
|
308b85 |
|
|
|
308b85 |
Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
|
|
|
308b85 |
Co-authored-by: dsotirakis <dimitrios.sotirakis@grafana.com>
|
|
|
308b85 |
|
|
|
308b85 |
diff --git a/pkg/services/sqlstore/user.go b/pkg/services/sqlstore/user.go
|
|
|
308b85 |
index 3dba16a75e..d773bd9dfe 100644
|
|
|
308b85 |
--- a/pkg/services/sqlstore/user.go
|
|
|
308b85 |
+++ b/pkg/services/sqlstore/user.go
|
|
|
308b85 |
@@ -298,19 +298,24 @@ func GetUserByLogin(query *models.GetUserByLoginQuery) error {
|
|
|
308b85 |
return models.ErrUserNotFound
|
|
|
308b85 |
}
|
|
|
308b85 |
|
|
|
308b85 |
- // Try and find the user by login first.
|
|
|
308b85 |
- // It's not sufficient to assume that a LoginOrEmail with an "@" is an email.
|
|
|
308b85 |
+ var has bool
|
|
|
308b85 |
+ var err error
|
|
|
308b85 |
user := &models.User{Login: query.LoginOrEmail}
|
|
|
308b85 |
- has, err := x.Get(user)
|
|
|
308b85 |
|
|
|
308b85 |
- if err != nil {
|
|
|
308b85 |
- return err
|
|
|
308b85 |
+ // Since username can be an email address, attempt login with email address
|
|
|
308b85 |
+ // first if the login field has the "@" symbol.
|
|
|
308b85 |
+ if strings.Contains(query.LoginOrEmail, "@") {
|
|
|
308b85 |
+ user = &models.User{Email: query.LoginOrEmail}
|
|
|
308b85 |
+ has, err = x.Get(user)
|
|
|
308b85 |
+
|
|
|
308b85 |
+ if err != nil {
|
|
|
308b85 |
+ return err
|
|
|
308b85 |
+ }
|
|
|
308b85 |
}
|
|
|
308b85 |
|
|
|
308b85 |
- if !has && strings.Contains(query.LoginOrEmail, "@") {
|
|
|
308b85 |
- // If the user wasn't found, and it contains an "@" fallback to finding the
|
|
|
308b85 |
- // user by email.
|
|
|
308b85 |
- user = &models.User{Email: query.LoginOrEmail}
|
|
|
308b85 |
+ // Lookup the login field instead of email field
|
|
|
308b85 |
+ if !has {
|
|
|
308b85 |
+ user = &models.User{Login: query.LoginOrEmail}
|
|
|
308b85 |
has, err = x.Get(user)
|
|
|
308b85 |
}
|
|
|
308b85 |
|
|
|
308b85 |
diff --git a/pkg/services/sqlstore/user_test.go b/pkg/services/sqlstore/user_test.go
|
|
|
308b85 |
index aa796ffb02..7fb9d9be2a 100644
|
|
|
308b85 |
--- a/pkg/services/sqlstore/user_test.go
|
|
|
308b85 |
+++ b/pkg/services/sqlstore/user_test.go
|
|
|
308b85 |
@@ -42,6 +43,45 @@ func TestUserDataAccess(t *testing.T) {
|
|
|
308b85 |
})
|
|
|
308b85 |
})
|
|
|
308b85 |
|
|
|
308b85 |
+ Convey("Get User by login - user_2 uses user_1.email as login", func() {
|
|
|
308b85 |
+ ss = InitTestDB(t)
|
|
|
308b85 |
+
|
|
|
308b85 |
+ // create user_1
|
|
|
308b85 |
+ cmd1 := &models.CreateUserCommand{
|
|
|
308b85 |
+ Email: "user_1@mail.com",
|
|
|
308b85 |
+ Name: "user_1",
|
|
|
308b85 |
+ Login: "user_1",
|
|
|
308b85 |
+ Password: "user_1_password",
|
|
|
308b85 |
+ IsDisabled: true,
|
|
|
308b85 |
+ }
|
|
|
308b85 |
+ err := CreateUser(context.Background(), cmd1)
|
|
|
308b85 |
+ So(err, ShouldBeNil)
|
|
|
308b85 |
+
|
|
|
308b85 |
+ // create user_2
|
|
|
308b85 |
+ cmd2 := &models.CreateUserCommand{
|
|
|
308b85 |
+ Email: "user_2@mail.com",
|
|
|
308b85 |
+ Name: "user_2",
|
|
|
308b85 |
+ Login: "user_1@mail.com",
|
|
|
308b85 |
+ Password: "user_2_password",
|
|
|
308b85 |
+ IsDisabled: true,
|
|
|
308b85 |
+ }
|
|
|
308b85 |
+ err = CreateUser(context.Background(), cmd2)
|
|
|
308b85 |
+ So(err, ShouldBeNil)
|
|
|
308b85 |
+
|
|
|
308b85 |
+ // query user database for user_1 email
|
|
|
308b85 |
+ query := models.GetUserByLoginQuery{LoginOrEmail: "user_1@mail.com"}
|
|
|
308b85 |
+ err = GetUserByLogin(&query)
|
|
|
308b85 |
+ So(err, ShouldBeNil)
|
|
|
308b85 |
+
|
|
|
308b85 |
+ // expect user_1 as result
|
|
|
308b85 |
+ So(query.Result.Email, ShouldEqual, cmd1.Email)
|
|
|
308b85 |
+ So(query.Result.Login, ShouldEqual, cmd1.Login)
|
|
|
308b85 |
+ So(query.Result.Name, ShouldEqual, cmd1.Name)
|
|
|
308b85 |
+ So(query.Result.Email, ShouldNotEqual, cmd2.Email)
|
|
|
308b85 |
+ So(query.Result.Login, ShouldNotEqual, cmd2.Login)
|
|
|
308b85 |
+ So(query.Result.Name, ShouldNotEqual, cmd2.Name)
|
|
|
308b85 |
+ })
|
|
|
308b85 |
+
|
|
|
308b85 |
Convey("Creates disabled user", func() {
|
|
|
308b85 |
cmd := &models.CreateUserCommand{
|
|
|
308b85 |
Email: "usertest@test.com",
|