Cutlery/jellyfin
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2025-07-09 03:04:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix FirstTimeSetupPolicy allowing guest access (#11651)

Browse Source
This commit is contained in:
Bill Thornton 2024-05-15 09:06:10 -04:00 committed by GitHub
parent 3f760e6685
commit 2cb052a119
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Jellyfin.Api/Auth/FirstTimeSetupPolicy/FirstTimeSetupHandler.cs
View File

@ -32,6 +32,10 @@ namespace Jellyfin.Api.Auth.FirstTimeSetupPolicy
{ {
context.Fail(); context.Fail();
} }
else if (!requirement.RequireAdmin && context.User.IsInRole(UserRoles.Guest))
{
context.Fail();
}
else else
{ {
// Any user-specific checks are handled in the DefaultAuthorizationHandler. // Any user-specific checks are handled in the DefaultAuthorizationHandler.

21
tests/Jellyfin.Api.Tests/Auth/FirstTimeSetupPolicy/FirstTimeSetupHandlerTests.cs
View File

@ -69,6 +69,27 @@ namespace Jellyfin.Api.Tests.Auth.FirstTimeSetupPolicy
Assert.Equal(shouldSucceed, context.HasSucceeded); Assert.Equal(shouldSucceed, context.HasSucceeded);
} }
[Theory]
[InlineData(UserRoles.Administrator, true)]
[InlineData(UserRoles.Guest, false)]
[InlineData(UserRoles.User, true)]
public async Task ShouldRequireUserIfNotRequiresAdmin(string userRole, bool shouldSucceed)
{
TestHelpers.SetupConfigurationManager(_configurationManagerMock, true);
var claims = TestHelpers.SetupUser(
_userManagerMock,
_httpContextAccessor,
userRole);
var context = new AuthorizationHandlerContext(
new List<IAuthorizationRequirement> { new FirstTimeSetupRequirement(false, false) },
claims,
null);
await _firstTimeSetupHandler.HandleAsync(context);
Assert.Equal(shouldSucceed, context.HasSucceeded);
}
[Fact] [Fact]
public async Task ShouldAllowAdminApiKeyIfStartupWizardComplete() public async Task ShouldAllowAdminApiKeyIfStartupWizardComplete()
{ {