jnd/beszel-ipv6
1
0
Fork 0
mirror of https://github.com/henrygd/beszel.git synced 2026-09-21 08:57:48 +02:00
Code Issues Packages Projects Releases 2 Wiki Activity

fix(hub): user alerts idor

Browse Source 
fixes very unlikely scenario where user guesses another user's 15
character random system id and adds alerts for it
This commit is contained in:
henrygd
2026-08-21 17:25:09 -04:00
parent 946f2e6be1
commit 6f92b9396d
4 changed files with 139 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
internal/hub/collections_test.go
View File

@@ -357,6 +357,13 @@ func TestApiCollectionsAuthRules(t *testing.T) {
"host": "127.0.0.2",
})
userOneAlert, _ := beszelTests.CreateRecord(hub, "alerts", map[string]any{
"name": "CPU", "system": userOneSystem.Id, "user": user1.Id, "value": 80,
})
userTwoAlert, _ := beszelTests.CreateRecord(hub, "alerts", map[string]any{
"name": "CPU", "system": userTwoSystem.Id, "user": user2.Id, "value": 80,
})
userRecords, _ := hub.CountRecords("users")
assert.EqualValues(t, 3, userRecords, "all users should be created")
@@ -368,6 +375,30 @@ func TestApiCollectionsAuthRules(t *testing.T) {
}
scenarios := []beszelTests.ApiScenario{
{
Name: "Users can only list their own alerts",
Method: http.MethodGet,
URL: "/api/collections/alerts/records",
Headers: map[string]string{
"Authorization": user1Token,
},
ExpectedStatus: 200,
ExpectedContent: []string{userOneAlert.Id},
NotExpectedContent: []string{userTwoAlert.Id},
TestAppFactory: testAppFactory,
},
{
Name: "Users cannot view another user's alert by id",
Method: http.MethodGet,
URL: fmt.Sprintf("/api/collections/alerts/records/%s", userTwoAlert.Id),
Headers: map[string]string{
"Authorization": user1Token,
},
ExpectedStatus: 403,
ExpectedContent: []string{"Only superusers"},
NotExpectedContent: []string{userTwoAlert.Id},
TestAppFactory: testAppFactory,
},
{
Name: "Unauthorized user cannot list systems",
Method: http.MethodGet,