OrgGo/Mainflux.mainflux
1
0
Fork 0
mirror of https://github.com/mainflux/mainflux.git synced 2025-04-24 13:48:49 +08:00
Code Issues Projects Releases Wiki Activity

Fix user listing access control (#1546)

Browse Source 
Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>
This commit is contained in:
Dušan Borovčanin 2022-01-19 16:46:10 +01:00 committed by GitHub
parent d86a4dee92
commit bcc8cf7119
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
api/users.yml
View File

@ -46,7 +46,9 @@ paths:
'400':
description: Failed due to malformed query parameters.
'401':
description: Missing or invalid access token provided.
description: |
Missing or invalid access token provided.
This endpoint is available only for administrators.
'404':
description: A non-existent entity request.
'422':

5
users/service.go
View File

@ -251,11 +251,14 @@ func (svc usersService) ViewProfile(ctx context.Context, token string) (User, er
}
func (svc usersService) ListUsers(ctx context.Context, token string, offset, limit uint64, email string, m Metadata) (UserPage, error) {
_, err := svc.identify(ctx, token)
id, err := svc.identify(ctx, token)
if err != nil {
return UserPage{}, err
}
if err := svc.authorize(ctx, id.id, "authorities", "member"); err != nil {
return UserPage{}, errors.Wrap(ErrUnauthorizedAccess, err)
}
return svc.users.RetrieveAll(ctx, offset, limit, nil, email, m)
}