jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Remove SDK Role

Browse Source 
Just compare with the token's clientId instead
This commit is contained in:
Girish Ramakrishnan
2018-04-30 23:03:28 -07:00
parent 240ee5f563
commit 23bc0e8db7
6 changed files with 11 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/routes/users.js
View File

@@ -11,8 +11,7 @@ exports = module.exports = {
setGroups: setGroups
};
var accesscontrol = require('../accesscontrol.js'),
assert = require('assert'),
var assert = require('assert'),
constants = require('../constants.js'),
generatePassword = require('../password.js').generate,
HttpError = require('connect-lastmile').HttpError,
@@ -129,8 +128,7 @@ function verifyPassword(req, res, next) {
assert.strictEqual(typeof req.body, 'object');
// using an 'sdk' token we skip password checks
var error = accesscontrol.validateRequestedScopes(req.authInfo || null, [ accesscontrol.SCOPE_ROLE_SDK ]);
if (!error) return next();
if (req.authInfo.clientId === 'cid-sdk' || req.authInfo.clientId === 'cid-cli') return next();
if (typeof req.body.password !== 'string') return next(new HttpError(400, 'API call requires user password'));