Cutlery/Kavita
1
0
Fork 0
mirror of https://github.com/Kareadita/Kavita.git synced 2025-07-09 03:04:19 -04:00
Code Issues Packages Projects Releases Wiki Activity

Ensure I validate before attempting to update password for reset password flow. Send some validation issues back to FE.

Browse Source
This commit is contained in:
Joseph Milazzo 2021-03-13 12:28:00 -06:00
parent 52b91a9b92
commit 983078de02
3 changed files with 30 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
API/Controllers/AccountController.cs
View File

@ -5,6 +5,7 @@ using System.Threading.Tasks;
using API.Constants; using API.Constants;
using API.DTOs; using API.DTOs;
using API.Entities; using API.Entities;
using API.Errors;
using API.Extensions; using API.Extensions;
using API.Interfaces; using API.Interfaces;
using API.Interfaces.Services; using API.Interfaces.Services;
@ -40,17 +41,40 @@ namespace API.Controllers
_mapper = mapper; _mapper = mapper;
} }
[Authorize(Policy = "RequireAdminRole")]
[HttpPost("reset-password")] [HttpPost("reset-password")]
public async Task<ActionResult> UpdatePassword(ResetPasswordDto resetPasswordDto) public async Task<ActionResult> UpdatePassword(ResetPasswordDto resetPasswordDto)
{ {
_logger.LogInformation("{UserName} is changing {ResetUser}'s password", User.GetUsername(), resetPasswordDto.UserName); _logger.LogInformation("{UserName} is changing {ResetUser}'s password", User.GetUsername(), resetPasswordDto.UserName);
var user = await _userManager.Users.SingleAsync(x => x.UserName == resetPasswordDto.UserName); var user = await _userManager.Users.SingleAsync(x => x.UserName == resetPasswordDto.UserName);
var isAdmin = await _userManager.IsInRoleAsync(user, PolicyConstants.AdminRole);
if (resetPasswordDto.UserName != User.GetUsername() && !isAdmin) return Unauthorized("You are not permitted to this operation.");
// Validate Password
foreach (var validator in _userManager.PasswordValidators)
{
var validationResult = await validator.ValidateAsync(_userManager, user, resetPasswordDto.Password);
if (!validationResult.Succeeded)
{
return BadRequest(
validationResult.Errors.Select(e => new ApiException(400, e.Code, e.Description)));
}
}
var result = await _userManager.RemovePasswordAsync(user); var result = await _userManager.RemovePasswordAsync(user);
if (!result.Succeeded) return BadRequest("Unable to update password"); if (!result.Succeeded)
{
_logger.LogError("Could not update password");
return BadRequest(result.Errors.Select(e => new ApiException(400, e.Code, e.Description)));
}
result = await _userManager.AddPasswordAsync(user, resetPasswordDto.Password); result = await _userManager.AddPasswordAsync(user, resetPasswordDto.Password);
if (!result.Succeeded) return BadRequest("Unable to update password"); if (!result.Succeeded)
{
_logger.LogError("Could not update password");
return BadRequest(result.Errors.Select(e => new ApiException(400, e.Code, e.Description)));
}
_logger.LogInformation("{User}'s Password has been reset", resetPasswordDto.UserName); _logger.LogInformation("{User}'s Password has been reset", resetPasswordDto.UserName);
return Ok(); return Ok();

5
API/Services/CacheService.cs
View File

@ -31,13 +31,10 @@ namespace API.Services
public void EnsureCacheDirectory() public void EnsureCacheDirectory()
{ {
// TODO: Replace with DirectoryService.ExistOrCreate()
_logger.LogDebug("Checking if valid Cache directory: {CacheDirectory}", CacheDirectory); _logger.LogDebug("Checking if valid Cache directory: {CacheDirectory}", CacheDirectory);
var di = new DirectoryInfo(CacheDirectory); if (_directoryService.ExistOrCreate(CacheDirectory))
if (!di.Exists)
{ {
_logger.LogError("Cache directory {CacheDirectory} is not accessible or does not exist. Creating...", CacheDirectory); _logger.LogError("Cache directory {CacheDirectory} is not accessible or does not exist. Creating...", CacheDirectory);
Directory.CreateDirectory(CacheDirectory);
} }
} }

2
API/Services/Tasks/ScannerService.cs
View File

@ -63,7 +63,7 @@ namespace API.Services.Tasks
_scannedSeries = null; _scannedSeries = null;
} }
[DisableConcurrentExecution(timeoutInSeconds: 360)] //[DisableConcurrentExecution(timeoutInSeconds: 360)]
public void ScanLibrary(int libraryId, bool forceUpdate) public void ScanLibrary(int libraryId, bool forceUpdate)
{ {
_forceUpdate = forceUpdate; _forceUpdate = forceUpdate;