johanels/photoprism
1
0
Fork 0
mirror of https://github.com/photoprism/photoprism.git synced 2025-12-12 00:34:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Auth: Delete user sessions after a permission level change #3512

Browse Source 
Signed-off-by: Michael Mayer <michael@photoprism.app>
This commit is contained in:
Michael Mayer
2023-07-18 16:38:10 +02:00
parent 44603857fa
commit 7b9b2ae0c6
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
internal/api/users_update.go
View File

@@ -78,11 +78,13 @@ func UpdateUser(router *gin.RouterGroup) {
// Log event.
event.AuditInfo([]string{ClientIP(c), "session %s", "users", m.UserName, "updated"}, s.RefID)
// Delete sessions after privilege level change.
if s.User().UserUID != m.UID() && isPrivileged {
// see https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change
// Delete user sessions after a permission level change.
// see https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change
if isPrivileged {
// Prevent the current session from being deleted.
deleted := m.DeleteSessions([]string{s.ID})
event.AuditInfo([]string{ClientIP(c), "session %s", "users", m.UserName, "invalidated %s"}, s.RefID,
english.Plural(m.DeleteSessions(nil), "session", "sessions"))
english.Plural(deleted, "session", "sessions"))
}
// Clear the session cache.