Upstream/bitwarden-server
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2024-11-22 12:15:36 +01:00
Code Issues Projects Releases Wiki Activity

check user has 2fa enabled when confirming

Browse Source
This commit is contained in:
Kyle Spearrin 2020-03-09 15:13:40 -04:00
parent 218fec52f1
commit 0f9ec8d64f
3 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Api/Controllers/OrganizationUsersController.cs
View File

@ -133,7 +133,8 @@ namespace Bit.Api.Controllers
}
var userId = _userService.GetProperUserId(User);
var result = await _organizationService.ConfirmUserAsync(orgGuidId, new Guid(id), model.Key, userId.Value);
var result = await _organizationService.ConfirmUserAsync(orgGuidId, new Guid(id), model.Key, userId.Value,
_userService);
}
[HttpPut("{id}")]

2
src/Core/Services/IOrganizationService.cs
View File

@ -38,7 +38,7 @@ namespace Bit.Core.Services
Task<OrganizationUser> AcceptUserAsync(Guid organizationUserId, User user, string token,
IUserService userService);
Task<OrganizationUser> ConfirmUserAsync(Guid organizationId, Guid organizationUserId, string key,
Guid confirmingUserId);
Guid confirmingUserId, IUserService userService);
Task SaveUserAsync(OrganizationUser user, Guid? savingUserId, IEnumerable<SelectionReadOnly> collections);
Task DeleteUserAsync(Guid organizationId, Guid organizationUserId, Guid? deletingUserId);
Task DeleteUserAsync(Guid organizationId, Guid userId);

12
src/Core/Services/Implementations/OrganizationService.cs
View File

@ -1028,7 +1028,7 @@ namespace Bit.Core.Services
}
public async Task<OrganizationUser> ConfirmUserAsync(Guid organizationId, Guid organizationUserId, string key,
Guid confirmingUserId)
Guid confirmingUserId, IUserService userService)
{
var orgUser = await _organizationUserRepository.GetByIdAsync(organizationUserId);
if(orgUser == null || orgUser.Status != OrganizationUserStatusType.Accepted ||
@ -1049,13 +1049,19 @@ namespace Bit.Core.Services
}
}
var user = await _userRepository.GetByIdAsync(orgUser.UserId.Value);
var policies = await _policyRepository.GetManyByOrganizationIdAsync(organizationId);
var usingTwoFactorPolicy = policies.Any(p => p.Type == PolicyType.TwoFactorAuthentication && p.Enabled);
if(usingTwoFactorPolicy && !(await userService.TwoFactorIsEnabledAsync(user)))
{
throw new BadRequestException("User does not have two-step login enabled.");
}
orgUser.Status = OrganizationUserStatusType.Confirmed;
orgUser.Key = key;
orgUser.Email = null;
await _organizationUserRepository.ReplaceAsync(orgUser);
await _eventService.LogOrganizationUserEventAsync(orgUser, EventType.OrganizationUser_Confirmed);
var user = await _userRepository.GetByIdAsync(orgUser.UserId.Value);
await _mailService.SendOrganizationConfirmedEmailAsync(org.Name, user.Email);
// push