github-starred/burp-ui
2
0
Fork 0
mirror of https://github.com/ziirish/burp-ui.git synced 2026-05-15 14:16:08 -06:00
Code Issues 1 Projects Packages Wiki Activity Actions

allow moderator to reset user password

Browse source
This commit is contained in:
ziirish 2018-10-15 20:16:10 +02:00
parent 3d4db7e17c
commit d2dd8afcec
No known key found for this signature in database
GPG key ID: 72DB229A64B54E46
2 changed files with 19 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
burpui/api/__init__.py
View file

@ -176,6 +176,21 @@ class Api(ApiPlus):
return decorated
return decorator
def acl_own_or_admin_or_moderator(self, key='name', message='Access denied', code=403):
def decorator(func):
@wraps(func)
def decorated(resource, *args, **kwargs):
if key not in kwargs: # pragma: no cover
resource.abort(500, "key '{}' not found".format(key))
if kwargs[key] != current_user.name and \
not current_user.is_anonymous and \
not current_user.acl.is_admin() and \
not current_user.acl.is_moderator():
resource.abort(code, message)
return func(resource, *args, **kwargs)
return decorated
return decorator
def disabled_on_demo(self):
def decorator(func):
@wraps(func)

8
burpui/api/admin.py
View file

@ -1531,7 +1531,7 @@ class AuthUsers(Resource):
return [[code, message]], status
@api.disabled_on_demo()
@api.acl_own_or_admin(key='name', message="Not allowed to modify this user")
@api.acl_own_or_admin_or_moderator(key='name', message="Not allowed to modify this user")
@ns.expect(parser_mod)
@ns.doc(
responses={
@ -1547,12 +1547,12 @@ class AuthUsers(Resource):
"""Change user password"""
args = self.parser_mod.parse_args()
backend = backend or args['backend']
is_admin = True
is_moderator = True
if not current_user.is_anonymous:
is_admin = current_user.acl.is_admin()
is_moderator = current_user.acl.is_admin() or current_user.acl.is_moderator()
if not is_admin and not args['old_password']:
if not is_moderator and not args['old_password']:
self.abort(400, "Old password required")
try: