You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
354 lines
13 KiB
354 lines
13 KiB
From 41a9a27cf0767828f38a390bbe7cf43f613b882e Mon Sep 17 00:00:00 2001
|
|
From: Andreas Gerstmayr <agerstmayr@redhat.com>
|
|
Date: Fri, 15 Jul 2022 14:05:14 +0200
|
|
Subject: [PATCH] fix CVE-2022-31107
|
|
|
|
backport 967e17d7ef6bc62a108add33ea699710f0e15870 from v8.4.10
|
|
|
|
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
|
|
Co-authored-by: Jguer <joao.guerreiro@grafana.com>
|
|
|
|
diff --git a/pkg/api/ldap_debug.go b/pkg/api/ldap_debug.go
|
|
index 126e760b67..c9e2b606c5 100644
|
|
--- a/pkg/api/ldap_debug.go
|
|
+++ b/pkg/api/ldap_debug.go
|
|
@@ -215,6 +215,11 @@ func (hs *HTTPServer) PostSyncUserWithLDAP(c *models.ReqContext) response.Respon
|
|
ReqContext: c,
|
|
ExternalUser: user,
|
|
SignupAllowed: hs.Cfg.LDAPAllowSignup,
|
|
+ UserLookupParams: models.UserLookupParams{
|
|
+ UserID: &query.Result.Id, // Upsert by ID only
|
|
+ Email: nil,
|
|
+ Login: nil,
|
|
+ },
|
|
}
|
|
|
|
err = bus.Dispatch(upsertCmd)
|
|
diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go
|
|
index 1fce9b6f61..611d51444f 100644
|
|
--- a/pkg/api/login_oauth.go
|
|
+++ b/pkg/api/login_oauth.go
|
|
@@ -250,6 +250,11 @@ func syncUser(
|
|
ReqContext: ctx,
|
|
ExternalUser: extUser,
|
|
SignupAllowed: connect.IsSignupAllowed(),
|
|
+ UserLookupParams: models.UserLookupParams{
|
|
+ Email: &extUser.Email,
|
|
+ UserID: nil,
|
|
+ Login: nil,
|
|
+ },
|
|
}
|
|
if err := bus.Dispatch(cmd); err != nil {
|
|
return nil, err
|
|
diff --git a/pkg/login/ldap_login.go b/pkg/login/ldap_login.go
|
|
index cb5d984e73..82dac2ee9e 100644
|
|
--- a/pkg/login/ldap_login.go
|
|
+++ b/pkg/login/ldap_login.go
|
|
@@ -56,9 +56,13 @@ var loginUsingLDAP = func(query *models.LoginUserQuery) (bool, error) {
|
|
ReqContext: query.ReqContext,
|
|
ExternalUser: externalUser,
|
|
SignupAllowed: setting.LDAPAllowSignup,
|
|
+ UserLookupParams: models.UserLookupParams{
|
|
+ Login: &externalUser.Login,
|
|
+ Email: &externalUser.Email,
|
|
+ UserID: nil,
|
|
+ },
|
|
}
|
|
- err = bus.Dispatch(upsert)
|
|
- if err != nil {
|
|
+ if err = bus.Dispatch(upsert); err != nil {
|
|
return true, err
|
|
}
|
|
query.User = upsert.Result
|
|
diff --git a/pkg/models/user_auth.go b/pkg/models/user_auth.go
|
|
index 2061cf048b..a98efe659e 100644
|
|
--- a/pkg/models/user_auth.go
|
|
+++ b/pkg/models/user_auth.go
|
|
@@ -54,11 +54,11 @@ type RequestURIKey struct{}
|
|
// COMMANDS
|
|
|
|
type UpsertUserCommand struct {
|
|
- ReqContext *ReqContext
|
|
- ExternalUser *ExternalUserInfo
|
|
+ ReqContext *ReqContext
|
|
+ ExternalUser *ExternalUserInfo
|
|
+ UserLookupParams
|
|
+ Result *User
|
|
SignupAllowed bool
|
|
-
|
|
- Result *User
|
|
}
|
|
|
|
type SetAuthInfoCommand struct {
|
|
@@ -95,13 +95,18 @@ type LoginUserQuery struct {
|
|
type GetUserByAuthInfoQuery struct {
|
|
AuthModule string
|
|
AuthId string
|
|
- UserId int64
|
|
- Email string
|
|
- Login string
|
|
+ UserLookupParams
|
|
|
|
Result *User
|
|
}
|
|
|
|
+type UserLookupParams struct {
|
|
+ // Describes lookup order as well
|
|
+ UserID *int64 // if set, will try to find the user by id
|
|
+ Email *string // if set, will try to find the user by email
|
|
+ Login *string // if set, will try to find the user by login
|
|
+}
|
|
+
|
|
type GetExternalUserInfoByLoginQuery struct {
|
|
LoginOrEmail string
|
|
|
|
diff --git a/pkg/services/contexthandler/authproxy/authproxy.go b/pkg/services/contexthandler/authproxy/authproxy.go
|
|
index 80e5a5b9e0..0d834748a7 100644
|
|
--- a/pkg/services/contexthandler/authproxy/authproxy.go
|
|
+++ b/pkg/services/contexthandler/authproxy/authproxy.go
|
|
@@ -246,6 +246,11 @@ func (auth *AuthProxy) LoginViaLDAP() (int64, error) {
|
|
ReqContext: auth.ctx,
|
|
SignupAllowed: auth.cfg.LDAPAllowSignup,
|
|
ExternalUser: extUser,
|
|
+ UserLookupParams: models.UserLookupParams{
|
|
+ Login: &extUser.Login,
|
|
+ Email: &extUser.Email,
|
|
+ UserID: nil,
|
|
+ },
|
|
}
|
|
if err := bus.Dispatch(upsert); err != nil {
|
|
return 0, err
|
|
@@ -288,6 +293,11 @@ func (auth *AuthProxy) LoginViaHeader() (int64, error) {
|
|
ReqContext: auth.ctx,
|
|
SignupAllowed: auth.cfg.AuthProxyAutoSignUp,
|
|
ExternalUser: extUser,
|
|
+ UserLookupParams: models.UserLookupParams{
|
|
+ UserID: nil,
|
|
+ Login: &extUser.Login,
|
|
+ Email: &extUser.Email,
|
|
+ },
|
|
}
|
|
|
|
err := bus.Dispatch(upsert)
|
|
diff --git a/pkg/services/login/login.go b/pkg/services/login/login.go
|
|
index 9e08a36b06..b74d1d3e8f 100644
|
|
--- a/pkg/services/login/login.go
|
|
+++ b/pkg/services/login/login.go
|
|
@@ -37,11 +37,9 @@ func (ls *LoginService) UpsertUser(cmd *models.UpsertUserCommand) error {
|
|
extUser := cmd.ExternalUser
|
|
|
|
userQuery := &models.GetUserByAuthInfoQuery{
|
|
- AuthModule: extUser.AuthModule,
|
|
- AuthId: extUser.AuthId,
|
|
- UserId: extUser.UserId,
|
|
- Email: extUser.Email,
|
|
- Login: extUser.Login,
|
|
+ AuthModule: extUser.AuthModule,
|
|
+ AuthId: extUser.AuthId,
|
|
+ UserLookupParams: cmd.UserLookupParams,
|
|
}
|
|
if err := bus.Dispatch(userQuery); err != nil {
|
|
if !errors.Is(err, models.ErrUserNotFound) {
|
|
diff --git a/pkg/services/login/login_test.go b/pkg/services/login/login_test.go
|
|
index 04953b567a..dd84ee29c8 100644
|
|
--- a/pkg/services/login/login_test.go
|
|
+++ b/pkg/services/login/login_test.go
|
|
@@ -82,10 +82,12 @@ func Test_teamSync(t *testing.T) {
|
|
QuotaService: "a.QuotaService{},
|
|
}
|
|
|
|
- upserCmd := &models.UpsertUserCommand{ExternalUser: &models.ExternalUserInfo{Email: "test_user@example.org"}}
|
|
+ email := "test_user@example.org"
|
|
+ upserCmd := &models.UpsertUserCommand{ExternalUser: &models.ExternalUserInfo{Email: email},
|
|
+ UserLookupParams: models.UserLookupParams{Email: &email}}
|
|
expectedUser := &models.User{
|
|
Id: 1,
|
|
- Email: "test_user@example.org",
|
|
+ Email: email,
|
|
Name: "test_user",
|
|
Login: "test_user",
|
|
}
|
|
diff --git a/pkg/services/sqlstore/user_auth.go b/pkg/services/sqlstore/user_auth.go
|
|
index 9605ccce76..f6f0e510bc 100644
|
|
--- a/pkg/services/sqlstore/user_auth.go
|
|
+++ b/pkg/services/sqlstore/user_auth.go
|
|
@@ -40,11 +40,12 @@ func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
|
|
}
|
|
|
|
// if user id was specified and doesn't match the user_auth entry, remove it
|
|
- if query.UserId != 0 && query.UserId != authQuery.Result.UserId {
|
|
- err = DeleteAuthInfo(&models.DeleteAuthInfoCommand{
|
|
+ if query.UserLookupParams.UserID != nil &&
|
|
+ *query.UserLookupParams.UserID != 0 &&
|
|
+ *query.UserLookupParams.UserID != authQuery.Result.UserId {
|
|
+ if err := DeleteAuthInfo(&models.DeleteAuthInfoCommand{
|
|
UserAuth: authQuery.Result,
|
|
- })
|
|
- if err != nil {
|
|
+ }); err != nil {
|
|
sqlog.Error("Error removing user_auth entry", "error", err)
|
|
}
|
|
|
|
@@ -70,17 +71,18 @@ func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
|
|
}
|
|
}
|
|
|
|
+ params := query.UserLookupParams
|
|
// If not found, try to find the user by id
|
|
- if !has && query.UserId != 0 {
|
|
- has, err = x.Id(query.UserId).Get(user)
|
|
+ if !has && params.UserID != nil && *params.UserID != 0 {
|
|
+ has, err = x.Id(*params.UserID).Get(user)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
// If not found, try to find the user by email address
|
|
- if !has && query.Email != "" {
|
|
- user = &models.User{Email: query.Email}
|
|
+ if !has && params.Email != nil && *params.Email != "" {
|
|
+ user = &models.User{Email: *params.Email}
|
|
has, err = x.Get(user)
|
|
if err != nil {
|
|
return err
|
|
@@ -88,8 +90,8 @@ func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
|
|
}
|
|
|
|
// If not found, try to find the user by login
|
|
- if !has && query.Login != "" {
|
|
- user = &models.User{Login: query.Login}
|
|
+ if !has && params.Login != nil && *params.Login != "" {
|
|
+ user = &models.User{Login: *params.Login}
|
|
has, err = x.Get(user)
|
|
if err != nil {
|
|
return err
|
|
diff --git a/pkg/services/sqlstore/user_auth_test.go b/pkg/services/sqlstore/user_auth_test.go
|
|
index e5bb2379e5..d94ce34edb 100644
|
|
--- a/pkg/services/sqlstore/user_auth_test.go
|
|
+++ b/pkg/services/sqlstore/user_auth_test.go
|
|
@@ -45,7 +45,7 @@ func TestUserAuth(t *testing.T) {
|
|
// By Login
|
|
login := "loginuser0"
|
|
|
|
- query := &models.GetUserByAuthInfoQuery{Login: login}
|
|
+ query := &models.GetUserByAuthInfoQuery{UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err = GetUserByAuthInfo(query)
|
|
|
|
So(err, ShouldBeNil)
|
|
@@ -54,7 +54,7 @@ func TestUserAuth(t *testing.T) {
|
|
// By ID
|
|
id := query.Result.Id
|
|
|
|
- query = &models.GetUserByAuthInfoQuery{UserId: id}
|
|
+ query = &models.GetUserByAuthInfoQuery{UserLookupParams: models.UserLookupParams{UserID: &id}}
|
|
err = GetUserByAuthInfo(query)
|
|
|
|
So(err, ShouldBeNil)
|
|
@@ -63,7 +63,7 @@ func TestUserAuth(t *testing.T) {
|
|
// By Email
|
|
email := "user1@test.com"
|
|
|
|
- query = &models.GetUserByAuthInfoQuery{Email: email}
|
|
+ query = &models.GetUserByAuthInfoQuery{UserLookupParams: models.UserLookupParams{Email: &email}}
|
|
err = GetUserByAuthInfo(query)
|
|
|
|
So(err, ShouldBeNil)
|
|
@@ -72,7 +72,7 @@ func TestUserAuth(t *testing.T) {
|
|
// Don't find nonexistent user
|
|
email = "nonexistent@test.com"
|
|
|
|
- query = &models.GetUserByAuthInfoQuery{Email: email}
|
|
+ query = &models.GetUserByAuthInfoQuery{UserLookupParams: models.UserLookupParams{Email: &email}}
|
|
err = GetUserByAuthInfo(query)
|
|
|
|
So(err, ShouldEqual, models.ErrUserNotFound)
|
|
@@ -90,7 +90,7 @@ func TestUserAuth(t *testing.T) {
|
|
// create user_auth entry
|
|
login := "loginuser0"
|
|
|
|
- query.Login = login
|
|
+ query.UserLookupParams.Login = &login
|
|
err = GetUserByAuthInfo(query)
|
|
|
|
So(err, ShouldBeNil)
|
|
@@ -104,9 +104,9 @@ func TestUserAuth(t *testing.T) {
|
|
So(query.Result.Login, ShouldEqual, login)
|
|
|
|
// get with non-matching id
|
|
- id := query.Result.Id
|
|
+ idPlusOne := query.Result.Id + 1
|
|
|
|
- query.UserId = id + 1
|
|
+ query.UserLookupParams.UserID = &idPlusOne
|
|
err = GetUserByAuthInfo(query)
|
|
|
|
So(err, ShouldBeNil)
|
|
@@ -143,7 +143,7 @@ func TestUserAuth(t *testing.T) {
|
|
login := "loginuser0"
|
|
|
|
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
|
|
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test", AuthId: "test"}
|
|
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test", UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err = GetUserByAuthInfo(query)
|
|
|
|
So(err, ShouldBeNil)
|
|
@@ -178,7 +178,7 @@ func TestUserAuth(t *testing.T) {
|
|
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
|
|
// Make the first log-in during the past
|
|
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
|
|
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test1", AuthId: "test1"}
|
|
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "test1", AuthId: "test1", UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err = GetUserByAuthInfo(query)
|
|
getTime = time.Now
|
|
|
|
@@ -188,7 +188,7 @@ func TestUserAuth(t *testing.T) {
|
|
// Add a second auth module for this user
|
|
// Have this module's last log-in be more recent
|
|
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
|
|
- query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test2", AuthId: "test2"}
|
|
+ query = &models.GetUserByAuthInfoQuery{AuthModule: "test2", AuthId: "test2", UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err = GetUserByAuthInfo(query)
|
|
getTime = time.Now
|
|
|
|
diff --git a/pkg/services/sqlstore/user_test.go b/pkg/services/sqlstore/user_test.go
|
|
index 7da19f0ef4..aa796ffb02 100644
|
|
--- a/pkg/services/sqlstore/user_test.go
|
|
+++ b/pkg/services/sqlstore/user_test.go
|
|
@@ -455,7 +455,7 @@ func TestUserDataAccess(t *testing.T) {
|
|
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
|
|
// Make the first log-in during the past
|
|
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
|
|
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: "ldap0"}
|
|
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "ldap", AuthId: "ldap0", UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err := GetUserByAuthInfo(query)
|
|
getTime = time.Now
|
|
|
|
@@ -465,7 +465,7 @@ func TestUserDataAccess(t *testing.T) {
|
|
// Add a second auth module for this user
|
|
// Have this module's last log-in be more recent
|
|
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
|
|
- query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
|
|
+ query = &models.GetUserByAuthInfoQuery{AuthModule: "oauth", AuthId: "oauth0", UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err = GetUserByAuthInfo(query)
|
|
getTime = time.Now
|
|
|
|
@@ -511,7 +511,7 @@ func TestUserDataAccess(t *testing.T) {
|
|
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
|
|
// Make the first log-in during the past
|
|
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
|
|
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: fmt.Sprint("ldap", i)}
|
|
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "ldap", AuthId: fmt.Sprint("ldap", i), UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err := GetUserByAuthInfo(query)
|
|
getTime = time.Now
|
|
|
|
@@ -522,7 +522,7 @@ func TestUserDataAccess(t *testing.T) {
|
|
// Log in first user with oauth
|
|
login := "loginuser0"
|
|
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
|
|
- query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
|
|
+ query := &models.GetUserByAuthInfoQuery{AuthModule: "oauth", AuthId: "oauth0", UserLookupParams: models.UserLookupParams{Login: &login}}
|
|
err := GetUserByAuthInfo(query)
|
|
getTime = time.Now
|
|
|