starred/openobserve
1
0
Fork 0
mirror of https://github.com/openobserve/openobserve.git synced 2026-11-06 08:09:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: nobody can update root except root user (#6376)

Browse Source
This commit is contained in:
Subhra264
2025-03-24 17:36:15 +05:30
committed by GitHub
parent cac2ded2cf
commit 6352357ea2
1 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/service/users.rs
+18 -15
View File
@@ -192,8 +192,25 @@ pub async fn update_user(
user: UpdateUser,
) -> Result<HttpResponse, Error> {
let mut allow_password_update = false;
let is_email_root = is_root_user(email);
let existing_user = if is_root_user(email) {
// Only root user can update root user
if is_email_root && !self_update {
return Ok(HttpResponse::BadRequest().json(MetaHttpResponse::message(
http::StatusCode::BAD_REQUEST.into(),
"Root user cannot be updated".to_string(),
)));
}
// Nobody can update role to root user role
if !is_email_root && user.role.is_some() && user.role.as_ref().unwrap().eq(&UserRole::Root) {
return Ok(HttpResponse::BadRequest().json(MetaHttpResponse::message(
http::StatusCode::BAD_REQUEST.into(),
"Root user role cannot be updated".to_string(),
)));
}
let existing_user = if is_email_root {
db::user::get(None, email).await
} else {
db::user::get(Some(org_id), email).await
@@ -786,20 +803,6 @@ pub async fn root_user_exists() -> bool {
}
}
pub fn is_user_from_org(orgs: Vec<UserOrg>, org_id: &str) -> (bool, UserOrg) {
if orgs.is_empty() {
(false, UserOrg::default())
} else {
let mut local_orgs = orgs;
local_orgs.retain(|org| !org.name.eq(&org_id.to_string()));
if local_orgs.is_empty() {
(false, UserOrg::default())
} else {
(true, local_orgs.first().unwrap().clone())
}
}
}
pub(crate) async fn create_root_user(org_id: &str, usr_req: UserRequest) -> Result<(), Error> {
let cfg = get_config();
let salt = ider::uuid();