Docker/portainer
Docker/portainer
1
0
Fork 0
mirror of https://github.com/portainer/portainer.git synced 2025-07-23 07:19:41 +02:00
Code Issues Releases Activity

- standard user cannot delete another users api-keys (#6208) (#6217)

Browse source 
- added new method to get api key by ID
- added tests
This commit is contained in:
zees-dev 2021-12-06 10:21:33 +13:00 • committed by GitHub
parent 7cc28b10a0
commit 5839f96787
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 56 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
api/http/handler/users/user_remove_access_token.go
View file

@ -56,6 +56,15 @@ func (handler *Handler) userRemoveAccessToken(w http.ResponseWriter, r *http.Req
return &httperror.HandlerError{http.StatusInternalServerError, "Unable to find a user with the specified identifier inside the database", err}
}
// check if the key exists and the key belongs to the user
apiKey, err := handler.apiKeyService.GetAPIKey(portainer.APIKeyID(apiKeyID))
if err != nil {
return &httperror.HandlerError{http.StatusInternalServerError, "API Key not found", err}
}
if apiKey.UserID != portainer.UserID(userID) {
return &httperror.HandlerError{http.StatusForbidden, "Permission denied to remove api-key", httperrors.ErrUnauthorized}
}
err = handler.apiKeyService.DeleteAPIKey(portainer.APIKeyID(apiKeyID))
if err != nil {
if err == apikey.ErrInvalidAPIKey {