7x31
/
mailcow-dockerized
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Web] limit identity_provider function better

This commit is contained in:
FreddleSpl0it 2023-03-13 08:54:50 +01:00
parent 0a78c742d7
commit a7e309f1c8
No known key found for this signature in database
GPG Key ID: 00E14E7634F4BEC5
2 changed files with 13 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
data/web/inc/functions.inc.php
View File

@ -1899,17 +1899,9 @@ function rspamd_ui($action, $data = null) {
break;
}
}
function identity_provider($_action, $_data = null) {
function identity_provider($_action, $_data = null, $hide_secret = false) {
global $pdo;
if ($_SESSION['mailcow_cc_role'] != "admin") {
$_SESSION['return'][] = array(
'type' => 'danger',
'log' => array(__FUNCTION__, $_action, $_data),
'msg' => 'access_denied'
);
return false;
}
switch ($_action) {
case 'get':
@ -1920,13 +1912,20 @@ function identity_provider($_action, $_data = null) {
foreach($rows as $row){
$settings[$row["key"]] = $row["value"];
}
$_SESSION['return'][] = array(
'type' => 'success',
'log' => array(__FUNCTION__, $_action, $settings),
'msg' => 'admin_api_modified'
);
if ($hide_secret){
$settings['client_secret'] = '***********************';
}
return $settings;
case 'edit':
if ($_SESSION['mailcow_cc_role'] != "admin") {
$_SESSION['return'][] = array(
'type' => 'danger',
'log' => array(__FUNCTION__, $_action, $_data),
'msg' => 'access_denied'
);
return false;
}
$required_settings = array('server_url', 'authsource', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version');
foreach($required_settings as $setting){
if (!$_data[$setting]){

2
data/web/json_api.php
View File

@ -1611,8 +1611,6 @@ if (isset($_GET['query'])) {
}
}
break;
case "identity_provider":
process_get_return(identity_provider('get'));
break;
break;
// return no route found if no case is matched