gian/cloudstack-mirror
1
0
Fork 0
mirror of https://github.com/apache/cloudstack synced 2026-09-03 09:50:53 +00:00
Code Issues Actions 17 Packages Projects Releases Wiki Activity

server: fix access for disable user 2fa

Browse Source 
Only admins should be able to disable 2FA for a user.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
This commit is contained in:
Abhishek Kumar 2026-07-07 13:13:00 +05:30
parent 8221f62511
commit fb758afbbc
2 changed files with 35 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/src/main/java/com/cloud/user/AccountManagerImpl.java
View File

@ -3697,6 +3697,9 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
Account owner = _accountService.getActiveAccountById(caller.getId());
if (Boolean.TRUE.equals(cmd.getEnable())) {
if (cmd.getUserId() != null) {
throw new InvalidParameterValueException("User ID should not be provided when enabling 2FA for the current user");
}
checkAccess(caller, null, true, owner);
Long userId = CallContext.current().getCallingUserId();
@ -3745,6 +3748,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
UserVO userVO;
if (userId != null) {
userVO = validateUser(userId);
verifyCallerPrivilegeForUserOrAccountOperations(userVO);
owner = _accountService.getActiveAccountById(userVO.getAccountId());
} else {
userId = CallContext.current().getCallingUserId();

33
server/src/test/java/com/cloud/user/AccountManagerImplTest.java
View File

@ -1120,18 +1120,25 @@ public class AccountManagerImplTest extends AccountManagentImplTestBase {
}
@Test
public void testDisableUserTwoFactorAuthentication() {
public void testDisableUserTwoFactorAuthenticationByAdmin() {
Long userId = 1L;
Long accountId = 2L;
long accountId = 2L;
Long callerId = 100L;
UserVO userVO = Mockito.mock(UserVO.class);
Account caller = Mockito.mock(Account.class);
Mockito.when(caller.getType()).thenReturn(Account.Type.ADMIN);
Mockito.when(caller.getId()).thenReturn(callerId);
Account owner = Mockito.mock(Account.class);
Mockito.when(owner.getType()).thenReturn(Account.Type.NORMAL);
Mockito.doReturn(caller).when(accountManagerImpl).getCurrentCallingAccount();
Mockito.doReturn(true).when(accountManagerImpl).isRootAdmin(callerId);
Mockito.doNothing().when(accountManagerImpl).checkAccess(nullable(Account.class), Mockito.isNull(), nullable(Boolean.class), nullable(Account.class));
Mockito.when(userDaoMock.findById(userId)).thenReturn(userVO);
Mockito.when(userVO.getAccountId()).thenReturn(accountId);
Mockito.doReturn(owner).when(accountManagerImpl).getAccount(accountId);
Mockito.when(_accountService.getActiveAccountById(accountId)).thenReturn(owner);
userVoMock.setKeyFor2fa("EUJEAEDVOURFZTE6OGWVTJZMI54QGMIL");
@ -1148,6 +1155,27 @@ public class AccountManagerImplTest extends AccountManagentImplTestBase {
Assert.assertNull(userVoMock.getUser2faProvider());
}
@Test(expected = PermissionDeniedException.class)
public void testDisableUserTwoFactorAuthenticationForAdminByDomainAdmin() {
Long userId = 1L;
long accountId = 2L;
Long callerId = 100L;
UserVO userVO = Mockito.mock(UserVO.class);
Account caller = Mockito.mock(Account.class);
Mockito.when(caller.getType()).thenReturn(Account.Type.DOMAIN_ADMIN);
Mockito.when(caller.getId()).thenReturn(callerId);
Account owner = Mockito.mock(Account.class);
Mockito.when(owner.getType()).thenReturn(Account.Type.ADMIN);
Mockito.doReturn(caller).when(accountManagerImpl).getCurrentCallingAccount();
Mockito.when(userDaoMock.findById(userId)).thenReturn(userVO);
Mockito.when(userVO.getAccountId()).thenReturn(accountId);
Mockito.doReturn(owner).when(accountManagerImpl).getAccount(accountId);
accountManagerImpl.disableTwoFactorAuthentication(userId, caller, owner);
}
@Test(expected = CloudRuntimeException.class)
public void testVerify2FAcodeWhen2FAisNotEnabled() {
AccountVO accountMock = Mockito.mock(AccountVO.class);
@ -1196,6 +1224,7 @@ public class AccountManagerImplTest extends AccountManagentImplTestBase {
@Test
public void testEnable2FAcode() {
SetupUserTwoFactorAuthenticationCmd cmd = Mockito.mock(SetupUserTwoFactorAuthenticationCmd.class);
Mockito.when(cmd.getUserId()).thenReturn(null);
Mockito.when(cmd.getProvider()).thenReturn("staticpin");
AccountVO accountMock = Mockito.mock(AccountVO.class);