jnd/beszel-ipv6
1
0
Fork 0
mirror of https://github.com/henrygd/beszel.git synced 2026-09-21 08:57:48 +02:00
Code Issues Packages Projects Releases 2 Wiki Activity

fix(hub): user alerts idor

Browse Source 
fixes very unlikely scenario where user guesses another user's 15
character random system id and adds alerts for it
This commit is contained in:
henrygd
2026-08-21 17:25:09 -04:00
parent 946f2e6be1
commit 6f92b9396d
4 changed files with 139 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
internal/alerts/alerts_api_test.go
View File

@@ -190,6 +190,30 @@ func TestUserAlertsApi(t *testing.T) {
assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
},
},
{
Name: "POST ignores systems the user cannot access",
Method: http.MethodPost,
URL: "/api/beszel/user-alerts",
Headers: map[string]string{
"Authorization": user2Token,
},
ExpectedStatus: 200,
ExpectedContent: []string{"\"success\":true"},
TestAppFactory: testAppFactory,
Body: jsonReader(map[string]any{
"name": "CPU",
"systems": []string{system1.Id},
"value": 90,
"min": 10,
}),
BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
beszelTests.ClearCollection(t, app, "alerts")
},
AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
alerts, _ := app.CountRecords("alerts")
assert.Zero(t, alerts)
},
},
{
Name: "Overwrite: false, should not overwrite existing alert",
Method: http.MethodPost,
@@ -347,6 +371,31 @@ func TestUserAlertsApi(t *testing.T) {
assert.Zero(t, alerts, "should have 0 alerts")
},
},
{
Name: "DELETE ignores systems the user cannot access",
Method: http.MethodDelete,
URL: "/api/beszel/user-alerts",
Headers: map[string]string{
"Authorization": user2Token,
},
ExpectedStatus: 200,
ExpectedContent: []string{"\"count\":0", "\"success\":true"},
TestAppFactory: testAppFactory,
Body: jsonReader(map[string]any{
"name": "CPU",
"systems": []string{system1.Id},
}),
BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
beszelTests.ClearCollection(t, app, "alerts")
beszelTests.CreateRecord(app, "alerts", map[string]any{
"name": "CPU", "system": system1.Id, "user": user2.Id, "value": 80,
})
},
AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
alerts, _ := app.CountRecords("alerts")
assert.EqualValues(t, 1, alerts)
},
},
{
Name: "User 2 should not be able to delete alert of user 1",
Method: http.MethodDelete,